You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iggy.apache.org by "hubcio (via GitHub)" <gi...@apache.org> on 2026/06/29 09:10:30 UTC
[PR] fix(security): require read_servers permission for system snapshot [iggy]
hubcio opened a new pull request, #3579:
URL: https://github.com/apache/iggy/pull/3579
Both the binary GetSnapshot handler and HTTP POST /snapshot only
called ensure_authenticated, unlike sibling read-server endpoints
(get_stats, get_clients) which also check read_servers. Any
authenticated caller, including one with no granted permissions,
could trigger a host-wide diagnostic dump: process and /proc
network tables, kernel info, concatenated server logs, and
current_config.toml.
Add perm_get_snapshot, mirroring perm_get_stats (read_servers or
manage_servers), and invoke it after authentication on both
transports. The HTTP handler previously discarded the identity;
it now passes user_id into the check.
The existing permission suite never exercised snapshot, which is
why the gap went unnoticed; extend it to assert an unprivileged
user is rejected and read_servers/manage_servers users are not.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(security): require read_servers permission for system snapshot [iggy]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #3579:
URL: https://github.com/apache/iggy/pull/3579#issuecomment-4830800569
## [Codecov](https://app.codecov.io/gh/apache/iggy/pull/3579?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 72.29%. Comparing base ([`307fdb1`](https://app.codecov.io/gh/apache/iggy/commit/307fdb16dbf9685392e1d33b74bec3651782e8b9?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`8ed28c9`](https://app.codecov.io/gh/apache/iggy/commit/8ed28c96b1c3439e03221fede3362a8bc1b723be?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #3579 +/- ##
============================================
- Coverage 74.07% 72.29% -1.78%
Complexity 937 937
============================================
Files 1249 1186 -63
Lines 128248 123560 -4688
Branches 104116 104027 -89
============================================
- Hits 94994 89332 -5662
- Misses 30219 31280 +1061
+ Partials 3035 2948 -87
```
| [Components](https://app.codecov.io/gh/apache/iggy/pull/3579/components?src=pr&el=components&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [Rust Core](https://app.codecov.io/gh/apache/iggy/pull/3579/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `74.71% <ø> (-0.01%)` | :arrow_down: |
| [Java SDK](https://app.codecov.io/gh/apache/iggy/pull/3579/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `62.44% <ø> (ø)` | |
| [C# SDK](https://app.codecov.io/gh/apache/iggy/pull/3579/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `72.06% <ø> (ø)` | |
| [Python SDK](https://app.codecov.io/gh/apache/iggy/pull/3579/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `88.88% <ø> (ø)` | |
| [PHP SDK](https://app.codecov.io/gh/apache/iggy/pull/3579/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `84.29% <ø> (ø)` | |
| [Node SDK](https://app.codecov.io/gh/apache/iggy/pull/3579/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `87.27% <ø> (-4.08%)` | :arrow_down: |
| [Go SDK](https://app.codecov.io/gh/apache/iggy/pull/3579/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `15.66% <ø> (-24.48%)` | :arrow_down: |
| [Files with missing lines](https://app.codecov.io/gh/apache/iggy/pull/3579?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [...src/binary/handlers/system/get\_snapshot\_handler.rs](https://app.codecov.io/gh/apache/iggy/pull/3579?src=pr&el=tree&filepath=core%2Fserver%2Fsrc%2Fbinary%2Fhandlers%2Fsystem%2Fget_snapshot_handler.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9zZXJ2ZXIvc3JjL2JpbmFyeS9oYW5kbGVycy9zeXN0ZW0vZ2V0X3NuYXBzaG90X2hhbmRsZXIucnM=) | `68.18% <ø> (ø)` | |
| [core/server/src/http/system.rs](https://app.codecov.io/gh/apache/iggy/pull/3579?src=pr&el=tree&filepath=core%2Fserver%2Fsrc%2Fhttp%2Fsystem.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9zZXJ2ZXIvc3JjL2h0dHAvc3lzdGVtLnJz) | `70.83% <ø> (-0.31%)` | :arrow_down: |
| [core/server/src/metadata/reader.rs](https://app.codecov.io/gh/apache/iggy/pull/3579?src=pr&el=tree&filepath=core%2Fserver%2Fsrc%2Fmetadata%2Freader.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9zZXJ2ZXIvc3JjL21ldGFkYXRhL3JlYWRlci5ycw==) | `77.71% <ø> (ø)` | |
... and [123 files with indirect coverage changes](https://app.codecov.io/gh/apache/iggy/pull/3579/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(security): require read_servers permission for system snapshot [iggy]
Posted by "hubcio (via GitHub)" <gi...@apache.org>.
hubcio merged PR #3579:
URL: https://github.com/apache/iggy/pull/3579
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org