DeforaNetworks/corteza
3
0
Fork 0
Code Activity

Remove the insecure report run endpoint

Browse Source
This commit is contained in:
Tomaž Jerman
2021-09-24 14:59:58 +02:00
parent 9a1c91675b
commit c7975bbf40
7 changed files with 34 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
system/rest.yaml
+1 -11
View File
@@ -1441,7 +1441,7 @@ endpoints:
title: Report ID
- name: describe
method: POST
title: Describe report (fresh)
title: Describe report
path: "/describe"
parameters:
post:
@@ -1449,16 +1449,6 @@ endpoints:
- { name: steps, type: "report.StepDefinitionSet", title: Report steps definition }
- { name: describe, type: "[]string", title: The source descriptions to generate }
# @todo better name
- name: runFresh
method: POST
title: Run report (fresh)
path: "/run"
parameters:
post:
- { name: sources, type: "types.ReportDataSourceSet", title: Report steps definition }
- { name: steps, type: "report.StepDefinitionSet", title: Report steps definition }
- { name: frames, type: "report.FrameDefinitionSet", title: Report data frame definitions }
- name: run
method: POST
title: Run report
system/rest/handlers/report.go
-19
View File
@@ -26,7 +26,6 @@ type (
Delete(context.Context, *request.ReportDelete) (interface{}, error)
Undelete(context.Context, *request.ReportUndelete) (interface{}, error)
Describe(context.Context, *request.ReportDescribe) (interface{}, error)
RunFresh(context.Context, *request.ReportRunFresh) (interface{}, error)
Run(context.Context, *request.ReportRun) (interface{}, error)
}
@@ -39,7 +38,6 @@ type (
Delete func(http.ResponseWriter, *http.Request)
Undelete func(http.ResponseWriter, *http.Request)
Describe func(http.ResponseWriter, *http.Request)
RunFresh func(http.ResponseWriter, *http.Request)
Run func(http.ResponseWriter, *http.Request)
}
)
@@ -158,22 +156,6 @@ func NewReport(h ReportAPI) *Report {
api.Send(w, r, value)
},
RunFresh: func(w http.ResponseWriter, r *http.Request) {
defer r.Body.Close()
params := request.NewReportRunFresh()
if err := params.Fill(r); err != nil {
api.Send(w, r, err)
return
}
value, err := h.RunFresh(r.Context(), params)
if err != nil {
api.Send(w, r, err)
return
}
api.Send(w, r, value)
},
Run: func(w http.ResponseWriter, r *http.Request) {
defer r.Body.Close()
params := request.NewReportRun()
@@ -203,7 +185,6 @@ func (h Report) MountRoutes(r chi.Router, middlewares ...func(http.Handler) http
r.Delete("/reports/{reportID}", h.Delete)
r.Post("/reports/{reportID}/undelete", h.Undelete)
r.Post("/reports/describe", h.Describe)
r.Post("/reports/run", h.RunFresh)
r.Post("/reports/{reportID}/run", h.Run)
})
}
system/rest/report.go
+3 -10
View File
@@ -27,9 +27,7 @@ type (
Update(ctx context.Context, upd *types.Report) (app *types.Report, err error)
Delete(ctx context.Context, ID uint64) (err error)
Undelete(ctx context.Context, ID uint64) (err error)
// @todo
// Run(ctx context.Context, ID uint64, dd report.DatasetDefinitionSet) (rr *report.Matrix, err error)
RunFresh(ctx context.Context, src types.ReportDataSourceSet, st report.StepDefinitionSet, dd report.FrameDefinitionSet) (rr []*report.Frame, err error)
Run(ctx context.Context, ID uint64, dd report.FrameDefinitionSet) (rr []*report.Frame, err error)
DescribeFresh(ctx context.Context, src types.ReportDataSourceSet, st report.StepDefinitionSet, sources ...string) (out report.FrameDescriptionSet, err error)
}
@@ -135,17 +133,12 @@ func (ctrl *Report) Undelete(ctx context.Context, r *request.ReportUndelete) (in
return api.OK(), ctrl.report.Undelete(ctx, r.ReportID)
}
func (ctrl *Report) Run(ctx context.Context, r *request.ReportRun) (interface{}, error) {
// @todo...
return nil, nil
}
func (ctrl *Report) Describe(ctx context.Context, r *request.ReportDescribe) (interface{}, error) {
return ctrl.report.DescribeFresh(ctx, r.Sources, r.Steps, r.Describe...)
}
func (ctrl *Report) RunFresh(ctx context.Context, r *request.ReportRunFresh) (interface{}, error) {
rr, err := ctrl.report.RunFresh(ctx, r.Sources, r.Steps, r.Frames)
func (ctrl *Report) Run(ctx context.Context, r *request.ReportRun) (interface{}, error) {
rr, err := ctrl.report.Run(ctx, r.ReportID, r.Frames)
return ctrl.makeReportFramePayload(ctx, rr, err)
}
system/rest/request/report.go
-92
View File
@@ -165,23 +165,6 @@ type (
Describe []string
}
ReportRunFresh struct {
// Sources POST parameter
//
// Report steps definition
Sources types.ReportDataSourceSet
// Steps POST parameter
//
// Report steps definition
Steps report.StepDefinitionSet
// Frames POST parameter
//
// Report data frame definitions
Frames report.FrameDefinitionSet
}
ReportRun struct {
// ReportID PATH parameter
//
@@ -715,81 +698,6 @@ func (r *ReportDescribe) Fill(req *http.Request) (err error) {
return err
}
// NewReportRunFresh request
func NewReportRunFresh() *ReportRunFresh {
return &ReportRunFresh{}
}
// Auditable returns all auditable/loggable parameters
func (r ReportRunFresh) Auditable() map[string]interface{} {
return map[string]interface{}{
"sources": r.Sources,
"steps": r.Steps,
"frames": r.Frames,
}
}
// Auditable returns all auditable/loggable parameters
func (r ReportRunFresh) GetSources() types.ReportDataSourceSet {
return r.Sources
}
// Auditable returns all auditable/loggable parameters
func (r ReportRunFresh) GetSteps() report.StepDefinitionSet {
return r.Steps
}
// Auditable returns all auditable/loggable parameters
func (r ReportRunFresh) GetFrames() report.FrameDefinitionSet {
return r.Frames
}
// Fill processes request and fills internal variables
func (r *ReportRunFresh) Fill(req *http.Request) (err error) {
if strings.ToLower(req.Header.Get("content-type")) == "application/json" {
err = json.NewDecoder(req.Body).Decode(r)
switch {
case err == io.EOF:
err = nil
case err != nil:
return fmt.Errorf("error parsing http request body: %w", err)
}
}
{
if err = req.ParseForm(); err != nil {
return err
}
// POST params
//if val, ok := req.Form["sources[]"]; ok && len(val) > 0 {
// r.Sources, err = types.ReportDataSourceSet(val), nil
// if err != nil {
// return err
// }
//}
//if val, ok := req.Form["steps[]"]; ok && len(val) > 0 {
// r.Steps, err = report.StepDefinitionSet(val), nil
// if err != nil {
// return err
// }
//}
//if val, ok := req.Form["frames[]"]; ok && len(val) > 0 {
// r.Frames, err = report.FrameDefinitionSet(val), nil
// if err != nil {
// return err
// }
//}
}
return err
}
// NewReportRun request
func NewReportRun() *ReportRun {
return &ReportRun{}
system/service/auth_actions.gen.go
Generated
+2 -3
View File
@@ -11,13 +11,12 @@ package service
import (
"context"
"fmt"
"strings"
"time"
"github.com/cortezaproject/corteza-server/pkg/actionlog"
"github.com/cortezaproject/corteza-server/pkg/errors"
"github.com/cortezaproject/corteza-server/pkg/locale"
"github.com/cortezaproject/corteza-server/system/types"
"strings"
"time"
)
type (
system/service/report.go
+18 -8
View File
@@ -284,11 +284,6 @@ func (svc *report) Undelete(ctx context.Context, ID uint64) (err error) {
return svc.recordAction(ctx, aaProps, ReportActionUndelete, err)
}
func (svc *report) Run(ctx context.Context, ID uint64, dd rep.FrameDefinitionSet) (rr interface{}, err error) {
// @todo follow the RunFresh definition here
return nil, nil
}
// actionlog?
func (svc *report) DescribeFresh(ctx context.Context, src types.ReportDataSourceSet, st rep.StepDefinitionSet, sources ...string) (out rep.FrameDescriptionSet, err error) {
// var (
@@ -328,19 +323,34 @@ func (svc *report) DescribeFresh(ctx context.Context, src types.ReportDataSource
return out, err
}
func (svc *report) RunFresh(ctx context.Context, src types.ReportDataSourceSet, st rep.StepDefinitionSet, dd rep.FrameDefinitionSet) (out []*rep.Frame, err error) {
func (svc *report) Run(ctx context.Context, reportID uint64, dd rep.FrameDefinitionSet) (out []*rep.Frame, err error) {
var (
aaProps = &reportActionProps{}
)
out = make([]*rep.Frame, 0, 4)
err = func() (err error) {
// @todo evt bus?
// if err = svc.eventbus.WaitFor(ctx, event.ReportBeforeUpdate(upd, report)); err != nil {
// return
// }
ss := src.ModelSteps()
ss = append(ss, st...)
if reportID == 0 {
return ReportErrInvalidID()
}
r, err := store.LookupReportByID(ctx, svc.store, reportID)
if err != nil {
return err
}
// - ac
if !svc.ac.CanRunReport(ctx, r) {
return ReportErrNotAllowedToRun()
}
ss := r.Sources.ModelSteps()
ss = append(ss, r.Projections.ModelSteps()...)
// Model the report
model, err := rep.Model(ctx, reporters, ss...)
system/types/report.go
+10 -1
View File
@@ -81,7 +81,6 @@ type (
}
)
// @todo make better
func (ss ReportDataSourceSet) ModelSteps() report.StepDefinitionSet {
out := make(report.StepDefinitionSet, 0, 124)
@@ -92,6 +91,16 @@ func (ss ReportDataSourceSet) ModelSteps() report.StepDefinitionSet {
return out
}
func (pp ReportProjectionSet) ModelSteps() report.StepDefinitionSet {
out := make(report.StepDefinitionSet, 0, 124)
for _, p := range pp {
out = append(out, p.Sources...)
}
return out
}
// Store stuff
func (vv *ReportMeta) Scan(value interface{}) error {