fix(security): add caller verification for more Manager and Updater methods - #457
fix(security): add caller verification for more Manager and Updater methods#457qiuzhiqian wants to merge 1 commit into
Conversation
…ethods Add sender parameter and checkInvokePermission calls to the following D-Bus methods that were missing authorization checks: Manager: GetArchivesInfo, PackageExists, PackageInstallable, GetUpdateLogs, GetHistoryLogs, PackagesSize, PackagesDownloadSize, RegisterAgent, SetAutoClean, UnRegisterAgent, QueryAllSizeWithSource, PowerOff, CanRollback Updater: GetCheckIntervalAndTime, ListMirrorSources, SetDeliveryDownloadSpeedLimit, SetDeliveryUploadSpeedLimit Bug: https://pms.uniontech.com/bug-view-371795.html
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @qiuzhiqian, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: qiuzhiqian The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
CLA Assistant Lite bot: |
Reviewer's GuideAdds D-Bus caller verification to several Manager and Updater methods by threading a sender parameter through their signatures and invoking existing permission checks before performing privileged operations. Sequence diagram for Manager methods with caller verificationsequenceDiagram
actor Client
participant DBus
participant Manager
Client->>DBus: GetArchivesInfo(sender)
DBus->>Manager: GetArchivesInfo(sender)
Manager->>Manager: checkInvokePermission(sender)
alt [permission denied]
Manager-->>DBus: dbusutil.ToError(err)
DBus-->>Client: error
else [permission granted]
Manager->>Manager: getArchiveInfo()
Manager-->>DBus: info, nil
DBus-->>Client: info
end
Sequence diagram for Updater methods with caller verificationsequenceDiagram
actor Client
participant DBus
participant Updater
participant Manager
Client->>DBus: SetDeliveryDownloadSpeedLimit(sender, limitConfig)
DBus->>Updater: SetDeliveryDownloadSpeedLimit(sender, limitConfig)
Updater->>Manager: checkInvokePermission(sender)
alt [permission denied]
Updater-->>DBus: dbusutil.ToError(err)
DBus-->>Client: error
else [permission granted]
Updater->>Updater: json.Unmarshal(limitConfig, speedLimitConfig)
Updater-->>DBus: nil
DBus-->>Client: ok
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
deepin pr auto review★ 总体评分：95分■ 【总体评价】
■ 【详细分析】
■ 【改进建议代码示例】 diff --git a/src/lastore-daemon/manager_ifc.go b/src/lastore-daemon/manager_ifc.go
index 8fb2efce8..b248658ee 100644
--- a/src/lastore-daemon/manager_ifc.go
+++ b/src/lastore-daemon/manager_ifc.go
@@ -69,8 +69,11 @@ func (m *Manager) FixError(sender dbus.Sender, errType string) (job dbus.ObjectP
return jobObj.getPath(), nil
}
-func (m *Manager) GetArchivesInfo() (info string, busErr *dbus.Error) {
+func (m *Manager) GetArchivesInfo(sender dbus.Sender) (info string, busErr *dbus.Error) {
m.service.DelayAutoQuit()
+ if err := m.checkInvokePermission(sender); err != nil {
+ return "", dbusutil.ToError(err)
+ }
info, err := getArchiveInfo()
if err != nil {
return "", dbusutil.ToError(err) |
2 participants
Add sender parameter and checkInvokePermission calls to the following D-Bus methods that were missing authorization checks:
Manager: GetArchivesInfo, PackageExists, PackageInstallable, GetUpdateLogs, GetHistoryLogs, PackagesSize, PackagesDownloadSize, RegisterAgent, SetAutoClean, UnRegisterAgent, QueryAllSizeWithSource, PowerOff, CanRollback
Updater: GetCheckIntervalAndTime, ListMirrorSources, SetDeliveryDownloadSpeedLimit, SetDeliveryUploadSpeedLimit
Bug: https://pms.uniontech.com/bug-view-371795.html
Summary by Sourcery
Enforce caller authorization for additional Manager and Updater D-Bus methods to close missing security checks.
Bug Fixes: