From bfb03d779d6b5daad180c4afb38dbb2d6fee3ace Mon Sep 17 00:00:00 2001 From: Karl Persson Date: Tue, 22 Mar 2022 13:48:15 +0100 Subject: [PATCH] Access Control: Correctly check for id suffix (#46824) * Correctly check for id suffix --- pkg/services/accesscontrol/filter.go | 2 +- pkg/services/accesscontrol/filter_test.go | 16 ++++++++++++++-- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/pkg/services/accesscontrol/filter.go b/pkg/services/accesscontrol/filter.go index 605e39cec78..cdfa4e50ca1 100644 --- a/pkg/services/accesscontrol/filter.go +++ b/pkg/services/accesscontrol/filter.go @@ -94,7 +94,7 @@ func parseScopes(prefix string, scopes []string) (ids map[interface{}]struct{}, } parser := parseStringAttribute - if strings.HasSuffix(prefix, "id:") { + if strings.HasSuffix(prefix, ":id:") { parser = parseIntAttribute } diff --git a/pkg/services/accesscontrol/filter_test.go b/pkg/services/accesscontrol/filter_test.go index ce26e71efaa..620bb283fcc 100644 --- a/pkg/services/accesscontrol/filter_test.go +++ b/pkg/services/accesscontrol/filter_test.go @@ -141,11 +141,23 @@ func TestFilter_Datasources(t *testing.T) { expectedDataSources: []string{"ds:3", "ds:7"}, expectErr: false, }, + { + desc: "expect to be filtered by uids", + sqlID: "data_source.uid", + prefix: "datasources:uid:", + actions: []string{"datasources:read"}, + permissions: map[string][]string{ + "datasources:read": {"datasources:uid:uid3", "datasources:uid:uid7"}, + }, + expectedDataSources: []string{"ds:3", "ds:7"}, + expectErr: false, + }, } // set sqlIDAcceptList before running tests restore := accesscontrol.SetAcceptListForTest(map[string]struct{}{ - "data_source.id": {}, + "data_source.id": {}, + "data_source.uid": {}, }) defer restore() @@ -158,7 +170,7 @@ func TestFilter_Datasources(t *testing.T) { // seed 10 data sources for i := 1; i <= 10; i++ { - err := store.AddDataSource(context.Background(), &models.AddDataSourceCommand{Name: fmt.Sprintf("ds:%d", i)}) + err := store.AddDataSource(context.Background(), &models.AddDataSourceCommand{Name: fmt.Sprintf("ds:%d", i), Uid: fmt.Sprintf("uid%d", i)}) require.NoError(t, err) }