[WEB-8283] fix: bind Spaces board object IDs to the anchor's project (GHSA-vqr2-wx56-gmq4)#9442
[WEB-8283] fix: bind Spaces board object IDs to the anchor's project (GHSA-vqr2-wx56-gmq4)#9442mguptahub wants to merge 3 commits into
Conversation
…(GHSA-vqr2-wx56-gmq4) The public Spaces board endpoints resolved the DeployBoard from the URL anchor but trusted the caller-supplied issue_id/comment_id/intake_id verbatim, without verifying the object belonged to that board's project/workspace. Any authenticated user could write comments, reactions and votes onto arbitrary issues cross-tenant, and read EXTERNAL comments from a different project in the same workspace. Bind every caller-supplied object id to the board's project + workspace before writing: - comment / issue-reaction / vote create: require the issue to exist in the board's project via Issue.issue_objects (excludes draft/archived/ triage), else 404. - comment-reaction create: require the comment to exist in the board's project with access="EXTERNAL", else 404. - intake create: require the URL intake_id to match the board's intake, else 400. - comment list read: scope the queryset to the board's project_id. Also add the missing is_votes_enabled gate on vote create for parity with comment/reaction create (pre-existing gap in the same method). Adds contract regression tests (fail-before verified): cross-tenant writes and the cross-project comment read now rejected, with positive controls confirming legitimate board writes/reads still succeed. Co-authored-by: Plane AI <noreply@plane.so>
|
Linked to Plane Work Item(s) This comment was auto-generated by Plane |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughPublic Spaces board endpoints now scope caller-supplied issue, comment, reaction, vote, and intake identifiers to the deploy board’s project and workspace. Contract tests cover rejected cross-project access, read isolation, feature gating, and valid board-owned operations. ChangesSpaces board object scoping
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR addresses GHSA-vqr2-wx56-gmq4 (CWE-862) by binding caller-supplied object IDs in public Spaces board endpoints (/api/public/anchor/<anchor>/...) to the resolved DeployBoard’s project + workspace, preventing cross-project/workspace writes (comments/reactions/votes/intake) and cross-project EXTERNAL comment reads.
Changes:
- Scope public comment-list queries to the board’s
project_idin addition toworkspace_id. - Add project/workspace binding checks for
issue_idandcomment_idon public write endpoints (comments, issue reactions, comment reactions, votes). - Bind
intake_idto the board’s configured intake and add a new contract test suite covering the regression.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| apps/api/plane/tests/contract/app/test_spaces_board_object_scope_app.py | Adds contract coverage for public anchor endpoints to prevent cross-project object-ID abuse. |
| apps/api/plane/space/views/issue.py | Scopes comment list by board project and validates issue/comment IDs belong to the board before writes; adds missing votes-enabled gate. |
| apps/api/plane/space/views/intake.py | Validates the URL intake_id matches the board’s intake before creating intake issues. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
apps/api/plane/space/views/issue.py (1)
267-275: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winExtract the repeated board-scope existence check into a shared helper.
The same "does this object belong to the board's project+workspace" check (existence query + 404 on mismatch) is duplicated near-verbatim across four
create()methods. Centralizing it reduces the risk that a future endpoint forgets the check or that one copy drifts from the others (this is exactly the class of bug this PR is fixing).♻️ Proposed helper extraction
+ `@staticmethod` + def _issue_in_board_scope(issue_id, project_deploy_board): + return Issue.issue_objects.filter( + id=issue_id, + project_id=project_deploy_board.project_id, + workspace_id=project_deploy_board.workspace_id, + ).exists() + def create(self, request, anchor, issue_id): ... - if not Issue.issue_objects.filter( - id=issue_id, - project_id=project_deploy_board.project_id, - workspace_id=project_deploy_board.workspace_id, - ).exists(): + if not self._issue_in_board_scope(issue_id, project_deploy_board): return Response({"error": "Issue not found"}, status=status.HTTP_404_NOT_FOUND)Apply similarly (with a
CommentReaction/IssueCommentvariant) to the comment-reaction check at Line 481-487.Also applies to: 385-393, 479-488, 574-589
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/api/plane/space/views/issue.py` around lines 267 - 275, Extract the repeated board-scope existence query and 404 response into a shared helper used by the four create() methods, including the Issue and CommentReaction/IssueComment variants. Update the checks near the issue and comment-reaction paths (and the corresponding locations) to call the helper with the object identifier and board scope, preserving the existing “Issue not found” or appropriate object-not-found response and preventing writes when project_id or workspace_id do not match.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/api/plane/space/views/issue.py`:
- Around line 267-275: Update the issue ownership checks around the visible
guard and the corresponding checks near the referenced comment/reaction/vote
handlers to use the unfiltered Issue.objects manager instead of
Issue.issue_objects, so archived issues remain eligible when they belong to the
board’s project and workspace.
---
Nitpick comments:
In `@apps/api/plane/space/views/issue.py`:
- Around line 267-275: Extract the repeated board-scope existence query and 404
response into a shared helper used by the four create() methods, including the
Issue and CommentReaction/IssueComment variants. Update the checks near the
issue and comment-reaction paths (and the corresponding locations) to call the
helper with the object identifier and board scope, preserving the existing
“Issue not found” or appropriate object-not-found response and preventing writes
when project_id or workspace_id do not match.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 52d19334-1a5f-418c-bd40-b56b47ebf9cd
📒 Files selected for processing (3)
apps/api/plane/space/views/intake.pyapps/api/plane/space/views/issue.pyapps/api/plane/tests/contract/app/test_spaces_board_object_scope_app.py
…abled coverage - Add cross-workspace write test (issue in a different workspace) to exercise the workspace_id binding, matching the advisory's cross-tenant impact (previously only same-workspace/different-project was covered). - Add a regression test for the new is_votes_enabled gate on vote create (votes-disabled board → 400), preventing the pre-existing gap from reappearing. - Clarify the section header comment: cross-tenant writes return 404 for issue/comment binding, 400 for the intake binding mismatch. Co-authored-by: Plane AI <noreply@plane.so>
|
Thanks @copilot — all three test-coverage points addressed in
Suite is now 14 tests (7 negative + 7 positive controls), all green; fail-before still verified for the security cases. |
Address CodeRabbit review: the identical "object belongs to the board's project+workspace" existence check was duplicated across four create() methods (in four different ViewSets). Extract two module-level helpers — _issue_in_board_scope and _comment_in_board_scope — so the check is a single source of truth and cannot drift between endpoints or be forgotten on a new one (the exact class of bug this PR fixes). Behavior-preserving; 14 contract tests still green. Co-authored-by: Plane AI <noreply@plane.so>
|
Thanks @coderabbitai — addressed in ✅ Helper extraction (nitpick). Pulled the duplicated board-scope check into two module-level helpers, ↩️ |
|
Tip For best results, initiate chat on the files or code changes.
The 🐇 ✅ ✏️ Learnings added
If you found this review helpful, would you consider giving us a shout-out on X? Thank you for using CodeRabbit! |
Summary
Fixes GHSA-vqr2-wx56-gmq4 (HIGH, CWE-862). The public Spaces board endpoints (
/api/public/anchor/<anchor>/...) resolved theDeployBoardfrom the URLanchorbut then trusted the caller-suppliedissue_id/comment_id/intake_idverbatim, without verifying the target object belonged to that board's project/workspace.Impact (before fix): any authenticated user could
Fix
Bind every caller-supplied object id to the board's project + workspace before writing (
apps/api/plane/space/views/issue.py,intake.py):Issue.issue_objects) → else 404access="EXTERNAL"→ else 404intake_idmust equalboard.intake_id→ else 400board.project_idIssue.issue_objectsis used deliberately — it excludes draft/archived/triage issues, matching exactly what the board already displays, so no legitimate write is rejected.Also adds the missing
is_votes_enabledgate on vote create for parity with comment/reaction create (a pre-existing gap in the same method).Tests
New contract suite
plane/tests/contract/app/test_spaces_board_object_scope_app.py(12 tests, fail-before verified — the 6 security tests fail without the fix):Verification
ruff check: cleanmanage.py check(test settings): no issuespytest(new suite + sibling deploy-board suite): all greenNotes / out of scope
asset.pycomment_idis not bound (non-cross-tenant integrity nit).🤖 Generated with Claude Code
Summary by CodeRabbit
Bug Fixes
Tests