[PR] Apply the nimbus ACLs to listBlobs so callers only see blobs they may read (storm)

["rzo1 (via GitHub)" <gi...@apache.org>]

rzo1 opened a new pull request, #9000:
URL: https://github.com/apache/storm/pull/9000

   `listBlobs` called `blobStore.listKeys()` with no authorization check and, unlike its neighbours `getBlobMeta` and `beginBlobDownload`, passed no `Subject`, so it returned every key in the store regardless of who asked. Extends `NimbusTest`.
   
   Worth a look during review: `storm-client/src/storm.thrift:763` declares `listBlobs` without `throws (1: AuthorizationException aze)`, and it is the only method in that family without one.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@storm.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Apply the nimbus ACLs to listBlobs so callers only see blobs they may read (storm)

["rzo1 (via GitHub)" <gi...@apache.org>]

rzo1 merged PR #9000:
URL: https://github.com/apache/storm/pull/9000


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@storm.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org