[PR] ATLAS-5372: Prevent cross-user overwrite in saved search create API v… [atlas]

["chaitalicod (via GitHub)" <gi...@apache.org>]

chaitalicod opened a new pull request, #724:
URL: https://github.com/apache/atlas/pull/724

   …ia caller-supplied guid
   
   ## What changes were proposed in this pull request?
   
   *PreRequisites*
   Two authenticated users with permissions to use saved-search APIs (for example: userA, userB).
   
   *Steps*
   Login as userA and create a saved search using:
   
   POST /api/atlas/v2/search/saved
   capture the returned guid (call it G1).
   Login as userB and send another create request to:
   
   POST /api/atlas/v2/search/saved
   include:
   ownerName = userB
   guid = G1
   different name / searchParameters.
   
   *Fetch saved searches for both users:*
   GET /api/atlas/v2/search/saved?user=userB
   GET /api/atlas/v2/search/saved?user=userA
   
   *Observed Result*
   The object with guid = G1 now appears under userB with updated content.
   userA no longer has that saved search entry with G1.
   
   *Expected Result*
   Create API should not allow client-supplied guid to update an existing saved-search object owned by another user.
   POST create should either reject non-empty guid or ignore it and always create a new object
   
   ## How was this patch tested?
   
   Ran tests
   ATLAS="http://localhost:21000/api/atlas/v2/search"
   U1="admin:admin"
   U2="bob:bob123"
   TS=$(date +%s)
   
   ADMIN_NAME="admin-search-$TS"
   BOB_NAME="bob-search-$TS"
   
   ADMIN_CREATE=$(curl -sS -u "$U1" -H "Content-Type: application/json" \
     -X POST "$ATLAS/saved" --data @- <<EOF
   {
     "guid":"",
     "name":"$ADMIN_NAME",
     "ownerName":"admin",
     "searchType":"BASIC",
     "searchParameters":{"typeName":"hive_table","excludeDeletedEntities":true}
   }
   EOF
   )
   
   echo "$ADMIN_CREATE" | jq .
   ADMIN_GUID=$(echo "$ADMIN_CREATE" | jq -r '.guid')
   echo "ADMIN_GUID=$ADMIN_GUID"
   
   BOB_OVERWRITE=$(curl -sS -u "$U2" -H "Content-Type: application/json" \
     -X POST "$ATLAS/saved" --data @- <<EOF
   {
     "guid":"$ADMIN_GUID",
     "name":"$BOB_NAME",
     "ownerName":"bob",
     "searchType":"BASIC",
     "searchParameters":{"typeName":"hive_table","excludeDeletedEntities":true}
   }
   EOF
   )
   
   echo "$BOB_OVERWRITE" | jq .
   {
     "guid": "6baabe6d-00c3-4e84-8481-4a67fa74f572",
     "ownerName": "admin",
     "name": "admin-search-1786438863",
     "searchType": "BASIC",
     "searchParameters": {
       "typeName": "hive_table",
       "excludeDeletedEntities": true,
       "includeClassificationAttributes": false,
       "includeSubTypes": true,
       "includeSubClassifications": true,
       "excludeHeaderAttributes": false,
       "limit": 0,
       "offset": 0
     }
   }
   ADMIN_GUID=6baabe6d-00c3-4e84-8481-4a67fa74f572
   {
     "errorCode": "ATLAS-400-00-029",
     "errorMessage": "invalid data"
   }


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@atlas.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] ATLAS-5372: Prevent cross-user overwrite in saved search create API v… [atlas]

["chaitalicod (via GitHub)" <gi...@apache.org>]

chaitalicod merged PR #724:
URL: https://github.com/apache/atlas/pull/724


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@atlas.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org