Commit fce9462a authored by Diego Molteni's avatar Diego Molteni
Browse files

fix: addressed service security vulnerabilities

parent 81bdf70d
This diff is collapsed.
......@@ -140,12 +140,18 @@ export class TenantHandler {
// get tenant path from data partition information
public static async getTenantSDPath(req: expRequest): Promise<string> {
const datapartition = TenantParser.dataPartition(req);
const dataPartition = TenantParser.dataPartition(req);
if (FeatureFlags.isEnabled(Feature.AUTHORIZATION)) {
await Auth.isUserRegistered(req.headers.authorization,
(await TenantDAO.get(dataPartition)).esd, req[Config.DE_FORWARD_APPKEY]);
}
try {
const tenants = await TenantDAO.getAll();
if (datapartition === 'slb') return (Config.SDPATHPREFIX + datapartition);
if (dataPartition === 'slb') return (Config.SDPATHPREFIX + dataPartition);
for (const tenant of tenants) {
if (tenant.esd.startsWith(datapartition)) {
if (tenant.esd.startsWith(dataPartition)) {
if (FeatureFlags.isEnabled(Feature.AUTHORIZATION)) {
await Auth.isUserRegistered(req.headers.authorization,
tenant.esd, req[Config.DE_FORWARD_APPKEY]);
......@@ -155,7 +161,7 @@ export class TenantHandler {
}
} catch (error) {
if ((error as ErrorModel).error.code === Error.Status.NOT_IMPLEMENTED) {
return Config.SDPATHPREFIX + datapartition;
return Config.SDPATHPREFIX + dataPartition;
} else { throw error; }
}
......
......@@ -97,8 +97,9 @@ export class TestTenantSVC {
Tx.testExp(async (done: any, expReq: expRequest, expRes: expResponse) => {
expReq.query.datapartition = 'datapartition';
this.sandbox.stub(TenantDAO, 'getAll').resolves([{ name: 'tenant01', default_acls: 'x', esd: 'datapartition.domain.com', gcpid: 'any' }]);
this.sandbox.stub(Auth, 'isUserRegistered').resolves();
this.sandbox.stub(TenantDAO, 'get').resolves({ name: 'tenant01', default_acls: 'x', esd: 'datapartition.domain.com', gcpid: 'any' });
this.sandbox.stub(TenantDAO, 'getAll').resolves([{ name: 'tenant01', default_acls: 'x', esd: 'datapartition.domain.com', gcpid: 'any' }]);
Tx.checkTrue((await TenantHandler.getTenantSDPath(expReq)) === Config.SDPATHPREFIX + 'tenant01', done);
});
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment