fix: Cross-Workspace Data-Source Schema Disclosure and Modification (Incomplete IDOR Remediation)

Author: XiaJunjie2020

backend/apps/datasource/api/datasource.py

@@ -163,8 +163,8 @@ async def get_fields(session: SessionDep,
     return getFields(session, id, table_name)
 
 
-@router.post("/syncFields/{id}", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_sync_fields")
-@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
+@router.post("/syncFields/{ds_id}/{id}", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_sync_fields")
+@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
 async def sync_fields(session: SessionDep, trans: Trans,
                       id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_id")):
     return sync_single_fields(session, trans, id)
@@ -200,27 +200,27 @@ async def table_list(session: SessionDep, id: int = Path(..., description=f"{PLA
     return get_tables_by_ds_id(session, id)
 
 
-@router.post("/fieldList/{id}", response_model=List[CoreField], summary=f"{PLACEHOLDER_PREFIX}ds_field_list")
-@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
+@router.post("/fieldList/{ds_id}/{id}", response_model=List[CoreField], summary=f"{PLACEHOLDER_PREFIX}ds_field_list")
+@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
 async def field_list(session: SessionDep, field: FieldObj,
                      id: int = Path(..., description=f"{PLACEHOLDER_PREFIX}ds_table_id")):
     return get_fields_by_table_id(session, id, field)
 
 
-@router.post("/editLocalComment", include_in_schema=False)
-@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
-async def edit_local(session: SessionDep, data: TableObj):
-    update_table_and_fields(session, data)
+# @router.post("/editLocalComment", include_in_schema=False)
+# @require_permissions(permission=SqlbotPermission(role=['ws_admin']))
+# async def edit_local(session: SessionDep, data: TableObj):
+#     update_table_and_fields(session, data)
 
 
 @router.post("/editTable", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_table")
-@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
+@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
 async def edit_table(session: SessionDep, table: CoreTable):
     updateTable(session, table)
 
 
 @router.post("/editField", response_model=None, summary=f"{PLACEHOLDER_PREFIX}ds_edit_field")
-@require_permissions(permission=SqlbotPermission(role=['ws_admin']))
+@require_permissions(permission=SqlbotPermission(role=['ws_admin'], type='ds', keyExpression="ds_id"))
 async def edit_field(session: SessionDep, field: CoreField):
     updateField(session, field)
 

frontend/src/api/datasource.ts

@@ -18,16 +18,15 @@ export const datasourceApi = {
     request.post(`/datasource/execSql/${id}`, { sql: sql }),
   chooseTables: (id: number, data: any) => request.post(`/datasource/chooseTables/${id}`, data),
   tableList: (id: number) => request.post(`/datasource/tableList/${id}`),
-  fieldList: (id: number, data = { fieldName: '' }) =>
-    request.post(`/datasource/fieldList/${id}`, data),
-  edit: (data: any) => request.post('/datasource/editLocalComment', data),
+  fieldList: (ds_id: number, id: number, data = { fieldName: '' }) =>
+    request.post(`/datasource/fieldList/${ds_id}/${id}`, data),
   previewData: (id: number, data: any) => request.post(`/datasource/previewData/${id}`, data),
   saveTable: (data: any) => request.post('/datasource/editTable', data),
   saveField: (data: any) => request.post('/datasource/editField', data),
   getDs: (id: number) => request.post(`/datasource/get/${id}`),
   cancelRequests: () => request.cancelRequests(),
   getSchema: (data: any) => request.post('/datasource/getSchemaByConf', data),
-  syncFields: (id: number) => request.post(`/datasource/syncFields/${id}`),
+  syncFields: (ds_id: number, id: number) => request.post(`/datasource/syncFields/${ds_id}/${id}`),
   exportDsSchema: (id: any) =>
     request.get(`/datasource/exportDsSchema/${id}`, {
       responseType: 'blob',

frontend/src/views/ds/DataTable.vue

@@ -168,7 +168,7 @@ const clickTable = (table: any) => {
   pageInfo.total = 0
   previewData.value = []
   datasourceApi
-    .fieldList(table.id)
+    .fieldList(table.ds_id, table.id)
     .then((res) => {
       fieldList.value = res
       pageInfo.total = res.length
@@ -259,7 +259,7 @@ const changeStatus = (row: any) => {
 const syncFields = () => {
   loading.value = true
   datasourceApi
-    .syncFields(currentTable.value.id)
+    .syncFields(currentTable.value.ds_id, currentTable.value.id)
     .then(() => {
       btnSelectClick('d')
       ElMessage.success(t('ds.sync_fields_success'))
@@ -343,7 +343,7 @@ const btnSelectClick = (val: any) => {
 
   if (val === 'd') {
     datasourceApi
-      .fieldList(currentTable.value.id, { fieldName: '' })
+      .fieldList(currentTable.value.ds_id, currentTable.value.id, { fieldName: '' })
       .then((res) => {
         fieldList.value = res
         pageInfo.total = res.length
@@ -497,9 +497,9 @@ const btnSelectClick = (val: any) => {
             >
               <el-switch
                 v-model="currentTable.checked"
-                @change="changeChecked"
                 size="small"
                 style="margin-right: 8px"
+                @change="changeChecked"
               />
 
               {{ currentTable.checked ? t('user.disable') : t('user.enable') }}

frontend/src/views/ds/TableList.vue

@@ -242,7 +242,7 @@ const saveField = () => {
 
 const clickTable = (table: any) => {
   currentTable.value = table
-  datasourceApi.fieldList(table.id).then((res) => {
+  datasourceApi.fieldList(table.ds_id, table.id).then((res) => {
     fieldList.value = res
     datasourceApi.previewData(dsId.value, buildData()).then((res) => {
       previewData.value = res

frontend/src/views/ds/TableRelationship.vue

@@ -366,7 +366,7 @@ const addNode = (node: any, tableX: any, tableY: any) => {
 const clickTable = (table: any) => {
   loading.value = true
   datasourceApi
-    .fieldList(table.id)
+    .fieldList(table.ds_id, table.id)
     .then((res: AnyColumn) => {
       const node = {
         id: table.id,

frontend/src/views/system/permission/index.vue

@@ -169,7 +169,7 @@ const getDsList = (row: any) => {
 
   if (row) {
     handleDsIdChange({ id: row.ds_id, name: row.ds_name })
-    handleEditeTable(row.table_id)
+    handleEditeTable(row.ds_id, row.table_id)
   }
 }
 const handleRowPermission = (row: any) => {
@@ -252,7 +252,7 @@ const handleDsIdChange = (val: any) => {
 const handleTableIdChange = (val: any) => {
   columnForm.table_id = val.id
   columnForm.table_name = val.table_name
-  datasourceApi.fieldList(val.id).then((res: any) => {
+  datasourceApi.fieldList(val.ds_id, val.id).then((res: any) => {
     fieldListOptions.value = res || []
     if (columnForm.type === 'row') return
     columnForm.permissions = fieldListOptions.value.map((ele) => {
@@ -262,9 +262,9 @@ const handleTableIdChange = (val: any) => {
   })
 }
 
-const handleEditeTable = (val: any) => {
+const handleEditeTable = (ds_id: any, val: any) => {
   datasourceApi
-    .fieldList(val)
+    .fieldList(ds_id, val)
     .then((res: any) => {
       fieldListOptions.value = res || []
       if (columnForm.type === 'row') return