[jira] [Updated] (CASSANDRA-21560) Validate authz before performing role check in LIST ROLES/PERMISSIONS

["Francisco Guerrero (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CASSANDRA-21560?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Francisco Guerrero updated CASSANDRA-21560:
-------------------------------------------
    Summary: Validate authz before performing role check in LIST ROLES/PERMISSIONS  (was: Validate authz before performing role check)

> Validate authz before performing role check in LIST ROLES/PERMISSIONS
> ---------------------------------------------------------------------
>
>                 Key: CASSANDRA-21560
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-21560
>             Project: Apache Cassandra
>          Issue Type: Bug
>          Components: Legacy/Core
>            Reporter: Francisco Guerrero
>            Assignee: Francisco Guerrero
>            Priority: Normal
>
> In {{ListPermissionsStatement}} and {{ListRolesStatement}} we perform a role check existence before ensuring the logged in user has access to list roles or permissions of that user.
> This could allow someone without access to list roles or permissions to check for existence of a role in the database, as the error message will show {{role foo does not exist}}.
> We should reverse the conditions and perform the validation before performing the role check.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org