fix(security): add caller verification for more Manager and Updater methods - #457
fix(security): add caller verification for more Manager and Updater methods#457qiuzhiqian wants to merge 1 commit into
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @qiuzhiqian, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
|
CLA Assistant Lite bot: |
Reviewer's GuideAdds D-Bus caller verification to several Manager and Updater methods by threading a sender parameter through their signatures and invoking existing permission checks before performing privileged operations. Sequence diagram for Manager methods with caller verificationsequenceDiagram
actor Client
participant DBus
participant Manager
Client->>DBus: GetArchivesInfo(sender)
DBus->>Manager: GetArchivesInfo(sender)
Manager->>Manager: checkInvokePermission(sender)
alt [permission denied]
Manager-->>DBus: dbusutil.ToError(err)
DBus-->>Client: error
else [permission granted]
Manager->>Manager: getArchiveInfo()
Manager-->>DBus: info, nil
DBus-->>Client: info
end
Sequence diagram for Updater methods with caller verificationsequenceDiagram
actor Client
participant DBus
participant Updater
participant Manager
Client->>DBus: SetDeliveryDownloadSpeedLimit(sender, limitConfig)
DBus->>Updater: SetDeliveryDownloadSpeedLimit(sender, limitConfig)
Updater->>Manager: checkInvokePermission(sender)
alt [permission denied]
Updater-->>DBus: dbusutil.ToError(err)
DBus-->>Client: error
else [permission granted]
Updater->>Updater: json.Unmarshal(limitConfig, speedLimitConfig)
Updater-->>DBus: nil
DBus-->>Client: ok
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
…ethods Add sender parameter and checkInvokePermission calls to the following D-Bus methods that were missing authorization checks: Manager: GetArchivesInfo, PackageExists, PackageInstallable, GetUpdateLogs, GetHistoryLogs, PackagesSize, PackagesDownloadSize, SetAutoClean, QueryAllSizeWithSource, PowerOff, CanRollback Updater: GetCheckIntervalAndTime, ListMirrorSources, SetDeliveryDownloadSpeedLimit, SetDeliveryUploadSpeedLimit Bug: https://pms.uniontech.com/bug-view-371795.html
b37b0fe to
3b165fe
Compare
deepin pr auto review★ 总体评分：100分■ 【总体评价】
■ 【详细分析】
■ 【改进建议代码示例】 // 当前代码已正确修复安全漏洞，无需额外修改。以下为最佳实践示例，确保权限校验的健壮性：
// 文件：src/lastore-daemon/manager_ifc.go
func (m *Manager) GetArchivesInfo(sender dbus.Sender) (info string, busErr *dbus.Error) {
m.service.DelayAutoQuit()
if err := m.checkInvokePermission(sender); err != nil {
return "", dbusutil.ToError(err)
}
info, err := getArchiveInfo()
if err != nil {
return "", dbusutil.ToError(err)
}
return info, nil
}
// 确保在 manager.go 中 checkInvokePermission 实现了严格的 Polkit 校验
// func (m *Manager) checkInvokePermission(sender dbus.Sender) error {
// // 获取调用者 PID 和 UID
// pid, err := m.service.GetConnPID(string(sender))
// if err != nil {
// return err
// }
// // 调用 Polkit 进行授权检查
// // ...
// } |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: qiuzhiqian, zhaohuiw42 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
3 participants
Add sender parameter and checkInvokePermission calls to the following D-Bus methods that were missing authorization checks:
Manager: GetArchivesInfo, PackageExists, PackageInstallable, GetUpdateLogs, GetHistoryLogs, PackagesSize, PackagesDownloadSize, RegisterAgent, SetAutoClean, UnRegisterAgent, QueryAllSizeWithSource, PowerOff, CanRollback
Updater: GetCheckIntervalAndTime, ListMirrorSources, SetDeliveryDownloadSpeedLimit, SetDeliveryUploadSpeedLimit
Bug: https://pms.uniontech.com/bug-view-371795.html
Summary by Sourcery
Enforce caller authorization for additional Manager and Updater D-Bus methods to close missing security checks.
Bug Fixes: