chore: Cherrypicks 1.23 - #9922
Open
triklozoid wants to merge 15 commits into
Open
triklozoid wants to merge 15 commits into
triklozoid wants to merge 15 commits into
Conversation
GitOrigin-RevId: 7bc2fd1e756e582fee1b76a3eebfa003e7c25ae4
… S3 storage project APIs GitOrigin-RevId: c0bac6de97041bf9915c37e7da1fe383b583d207
GitOrigin-RevId: 0e29d3c5761abc63e9c29f2cb32d6298b518216c
GitOrigin-RevId: f643d0fe67c898c1b9873d18f0fc3e17f49097f4
GitOrigin-RevId: 7888146616806d215548975f2a463a3f7a39d9dd
GitOrigin-RevId: 8941849bed47834e32fd15ba9729bac516927349
…incomplete fix) The CVE-2023-47117 fix added FilterSerializer.validate_column(), which only runs when a View is saved. Filters and ordering supplied inline never pass through that serializer: the ?query= GET param on the task list, the same payload in a POST body, and legacy persisted Views all flow from get_prepare_params() straight into Q(**{column: value}) / order_by(F(column)) with '__' relation traversal intact. Any authenticated project member could turn the task list into a boolean regex/order oracle over every column reachable from Task -- the organization owner's password hash and auth token, cloud storage credentials of other projects. Validate at the PrepareParams boundary instead, where every inline path lands: - filter columns are checked only when prefixed with `filter:tasks:`, because apply_filters() silently drops every other name before it can become an ORM lookup, and rejecting those would 400 requests that used to succeed; - ordering columns are checked unconditionally, since apply_ordering() feeds any spelling straight into F(...) with no prefix gate; - task.data key transforms and DATA_MANAGER_FILTER_ALLOWLIST entries stay allowed; - the nested child_filter is covered because pydantic validates it as a Filter too. Rewritten for the 1.23.0 code shape rather than cherry-picked: on develop the nested filter field is the list `child_filters`, here it is the single `child_filter`. Refs: GHSA-9q39-f8w9-75wm, GHSA-pcg6-5fw2-6f7f, GHSA-5hfg-77p7-ghvr, CVE-2023-47117 Port of develop commit 7e2f696
The has_permission tests cherry-picked with 198474e use Project directly; on develop the import was already there from an unrelated change that is not in 1.23.0.
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
* fix: PLT-1272: HTTP Adapter with SSRF protection * Fix tests GitOrigin-RevId: fd356e59c2aa0e465c85e78de6af8800fd9a89dd
fix: PLT-1272: Disable org creation by default GitOrigin-RevId: 8ed4c8f6f11be0ccb5a3531e7028fad7d7dc75bc
* fix: PLT-1272: Org owner protection for LSO * chore: update OpenAPI schema * chore: regenerate SDK preview --------- GitOrigin-RevId: b0b5a7da082d26f78bc71fd53b74abee8db69f25
GitOrigin-RevId: e4b5164ed9716edd496a0b5ae8fc5b214094e943
GitOrigin-RevId: 1dd044f62349307ab708180d47e3b47492ef9c8b
* fix: PLT-1272: SSRF protection for Redis storage host * fix: PLT-1272: use a public host in the LSE Redis storage test GitOrigin-RevId: 65695f28f9f251fd5e249809d0c53650847fbbd4
GitOrigin-RevId: 27199beca5057e303edabab150b637b28a7b4f72
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.