[GitHub] [jackrabbit-oak] kwin commented on a change in pull request #291: OAK-9415 expose the bound principals of a session as attribute

[GitBox <gi...@apache.org>]

kwin commented on a change in pull request #291:
URL: https://github.com/apache/jackrabbit-oak/pull/291#discussion_r622257772



##########
File path: oak-jcr/src/main/java/org/apache/jackrabbit/oak/jcr/session/SessionImpl.java
##########
@@ -248,11 +249,15 @@ public String getUserID() {
     public String[] getAttributeNames() {
         Set<String> names = newTreeSet(sessionContext.getAttributes().keySet());
         Collections.addAll(names, sd.getAuthInfo().getAttributeNames());
+        names.add(RepositoryImpl.BOUND_PRINCIPALS);
         return names.toArray(new String[names.size()]);
     }
 
     @Override
     public Object getAttribute(String name) {
+        if (RepositoryImpl.BOUND_PRINCIPALS.equals(name)) {

Review comment:
       That is IMHO dangerous, as the bound principals can be used for checking if certain code paths should be allowed (e.g. in the context of FileVault). If someone can forge these attributes by just creating a limited session with those parameters, this could easily be abused for privilege escalation. IMHO those values should not be allowed to be overwritten by consumers.




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org