From c7975bbf40cca64c7a513739ce489a77996cb279 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Toma=C5=BE=20Jerman?= Date: Fri, 24 Sep 2021 14:59:58 +0200 Subject: [PATCH] Remove the insecure report run endpoint --- system/rest.yaml | 12 +--- system/rest/handlers/report.go | 19 ------ system/rest/report.go | 13 +---- system/rest/request/report.go | 92 ------------------------------ system/service/auth_actions.gen.go | 5 +- system/service/report.go | 26 ++++++--- system/types/report.go | 11 +++- 7 files changed, 34 insertions(+), 144 deletions(-) diff --git a/system/rest.yaml b/system/rest.yaml index 75cb1547b..eeb0ee706 100644 --- a/system/rest.yaml +++ b/system/rest.yaml @@ -1441,7 +1441,7 @@ endpoints: title: Report ID - name: describe method: POST - title: Describe report (fresh) + title: Describe report path: "/describe" parameters: post: @@ -1449,16 +1449,6 @@ endpoints: - { name: steps, type: "report.StepDefinitionSet", title: Report steps definition } - { name: describe, type: "[]string", title: The source descriptions to generate } - # @todo better name - - name: runFresh - method: POST - title: Run report (fresh) - path: "/run" - parameters: - post: - - { name: sources, type: "types.ReportDataSourceSet", title: Report steps definition } - - { name: steps, type: "report.StepDefinitionSet", title: Report steps definition } - - { name: frames, type: "report.FrameDefinitionSet", title: Report data frame definitions } - name: run method: POST title: Run report diff --git a/system/rest/handlers/report.go b/system/rest/handlers/report.go index 2758b4663..f841f6edb 100644 --- a/system/rest/handlers/report.go +++ b/system/rest/handlers/report.go @@ -26,7 +26,6 @@ type ( Delete(context.Context, *request.ReportDelete) (interface{}, error) Undelete(context.Context, *request.ReportUndelete) (interface{}, error) Describe(context.Context, *request.ReportDescribe) (interface{}, error) - RunFresh(context.Context, *request.ReportRunFresh) (interface{}, error) Run(context.Context, *request.ReportRun) (interface{}, error) } @@ -39,7 +38,6 @@ type ( Delete func(http.ResponseWriter, *http.Request) Undelete func(http.ResponseWriter, *http.Request) Describe func(http.ResponseWriter, *http.Request) - RunFresh func(http.ResponseWriter, *http.Request) Run func(http.ResponseWriter, *http.Request) } ) @@ -158,22 +156,6 @@ func NewReport(h ReportAPI) *Report { api.Send(w, r, value) }, - RunFresh: func(w http.ResponseWriter, r *http.Request) { - defer r.Body.Close() - params := request.NewReportRunFresh() - if err := params.Fill(r); err != nil { - api.Send(w, r, err) - return - } - - value, err := h.RunFresh(r.Context(), params) - if err != nil { - api.Send(w, r, err) - return - } - - api.Send(w, r, value) - }, Run: func(w http.ResponseWriter, r *http.Request) { defer r.Body.Close() params := request.NewReportRun() @@ -203,7 +185,6 @@ func (h Report) MountRoutes(r chi.Router, middlewares ...func(http.Handler) http r.Delete("/reports/{reportID}", h.Delete) r.Post("/reports/{reportID}/undelete", h.Undelete) r.Post("/reports/describe", h.Describe) - r.Post("/reports/run", h.RunFresh) r.Post("/reports/{reportID}/run", h.Run) }) } diff --git a/system/rest/report.go b/system/rest/report.go index 689295a63..64a648d83 100644 --- a/system/rest/report.go +++ b/system/rest/report.go @@ -27,9 +27,7 @@ type ( Update(ctx context.Context, upd *types.Report) (app *types.Report, err error) Delete(ctx context.Context, ID uint64) (err error) Undelete(ctx context.Context, ID uint64) (err error) - // @todo - // Run(ctx context.Context, ID uint64, dd report.DatasetDefinitionSet) (rr *report.Matrix, err error) - RunFresh(ctx context.Context, src types.ReportDataSourceSet, st report.StepDefinitionSet, dd report.FrameDefinitionSet) (rr []*report.Frame, err error) + Run(ctx context.Context, ID uint64, dd report.FrameDefinitionSet) (rr []*report.Frame, err error) DescribeFresh(ctx context.Context, src types.ReportDataSourceSet, st report.StepDefinitionSet, sources ...string) (out report.FrameDescriptionSet, err error) } @@ -135,17 +133,12 @@ func (ctrl *Report) Undelete(ctx context.Context, r *request.ReportUndelete) (in return api.OK(), ctrl.report.Undelete(ctx, r.ReportID) } -func (ctrl *Report) Run(ctx context.Context, r *request.ReportRun) (interface{}, error) { - // @todo... - return nil, nil -} - func (ctrl *Report) Describe(ctx context.Context, r *request.ReportDescribe) (interface{}, error) { return ctrl.report.DescribeFresh(ctx, r.Sources, r.Steps, r.Describe...) } -func (ctrl *Report) RunFresh(ctx context.Context, r *request.ReportRunFresh) (interface{}, error) { - rr, err := ctrl.report.RunFresh(ctx, r.Sources, r.Steps, r.Frames) +func (ctrl *Report) Run(ctx context.Context, r *request.ReportRun) (interface{}, error) { + rr, err := ctrl.report.Run(ctx, r.ReportID, r.Frames) return ctrl.makeReportFramePayload(ctx, rr, err) } diff --git a/system/rest/request/report.go b/system/rest/request/report.go index 74962bc50..44ccbfc72 100644 --- a/system/rest/request/report.go +++ b/system/rest/request/report.go @@ -165,23 +165,6 @@ type ( Describe []string } - ReportRunFresh struct { - // Sources POST parameter - // - // Report steps definition - Sources types.ReportDataSourceSet - - // Steps POST parameter - // - // Report steps definition - Steps report.StepDefinitionSet - - // Frames POST parameter - // - // Report data frame definitions - Frames report.FrameDefinitionSet - } - ReportRun struct { // ReportID PATH parameter // @@ -715,81 +698,6 @@ func (r *ReportDescribe) Fill(req *http.Request) (err error) { return err } -// NewReportRunFresh request -func NewReportRunFresh() *ReportRunFresh { - return &ReportRunFresh{} -} - -// Auditable returns all auditable/loggable parameters -func (r ReportRunFresh) Auditable() map[string]interface{} { - return map[string]interface{}{ - "sources": r.Sources, - "steps": r.Steps, - "frames": r.Frames, - } -} - -// Auditable returns all auditable/loggable parameters -func (r ReportRunFresh) GetSources() types.ReportDataSourceSet { - return r.Sources -} - -// Auditable returns all auditable/loggable parameters -func (r ReportRunFresh) GetSteps() report.StepDefinitionSet { - return r.Steps -} - -// Auditable returns all auditable/loggable parameters -func (r ReportRunFresh) GetFrames() report.FrameDefinitionSet { - return r.Frames -} - -// Fill processes request and fills internal variables -func (r *ReportRunFresh) Fill(req *http.Request) (err error) { - - if strings.ToLower(req.Header.Get("content-type")) == "application/json" { - err = json.NewDecoder(req.Body).Decode(r) - - switch { - case err == io.EOF: - err = nil - case err != nil: - return fmt.Errorf("error parsing http request body: %w", err) - } - } - - { - if err = req.ParseForm(); err != nil { - return err - } - - // POST params - - //if val, ok := req.Form["sources[]"]; ok && len(val) > 0 { - // r.Sources, err = types.ReportDataSourceSet(val), nil - // if err != nil { - // return err - // } - //} - - //if val, ok := req.Form["steps[]"]; ok && len(val) > 0 { - // r.Steps, err = report.StepDefinitionSet(val), nil - // if err != nil { - // return err - // } - //} - - //if val, ok := req.Form["frames[]"]; ok && len(val) > 0 { - // r.Frames, err = report.FrameDefinitionSet(val), nil - // if err != nil { - // return err - // } - //} - } - - return err -} - // NewReportRun request func NewReportRun() *ReportRun { return &ReportRun{} diff --git a/system/service/auth_actions.gen.go b/system/service/auth_actions.gen.go index c0dbf1162..e9c5445e0 100644 --- a/system/service/auth_actions.gen.go +++ b/system/service/auth_actions.gen.go @@ -11,13 +11,12 @@ package service import ( "context" "fmt" - "strings" - "time" - "github.com/cortezaproject/corteza-server/pkg/actionlog" "github.com/cortezaproject/corteza-server/pkg/errors" "github.com/cortezaproject/corteza-server/pkg/locale" "github.com/cortezaproject/corteza-server/system/types" + "strings" + "time" ) type ( diff --git a/system/service/report.go b/system/service/report.go index 9c6bca15f..f32576cc5 100644 --- a/system/service/report.go +++ b/system/service/report.go @@ -284,11 +284,6 @@ func (svc *report) Undelete(ctx context.Context, ID uint64) (err error) { return svc.recordAction(ctx, aaProps, ReportActionUndelete, err) } -func (svc *report) Run(ctx context.Context, ID uint64, dd rep.FrameDefinitionSet) (rr interface{}, err error) { - // @todo follow the RunFresh definition here - return nil, nil -} - // actionlog? func (svc *report) DescribeFresh(ctx context.Context, src types.ReportDataSourceSet, st rep.StepDefinitionSet, sources ...string) (out rep.FrameDescriptionSet, err error) { // var ( @@ -328,19 +323,34 @@ func (svc *report) DescribeFresh(ctx context.Context, src types.ReportDataSource return out, err } -func (svc *report) RunFresh(ctx context.Context, src types.ReportDataSourceSet, st rep.StepDefinitionSet, dd rep.FrameDefinitionSet) (out []*rep.Frame, err error) { +func (svc *report) Run(ctx context.Context, reportID uint64, dd rep.FrameDefinitionSet) (out []*rep.Frame, err error) { var ( aaProps = &reportActionProps{} ) out = make([]*rep.Frame, 0, 4) err = func() (err error) { + // @todo evt bus? // if err = svc.eventbus.WaitFor(ctx, event.ReportBeforeUpdate(upd, report)); err != nil { // return // } - ss := src.ModelSteps() - ss = append(ss, st...) + if reportID == 0 { + return ReportErrInvalidID() + } + + r, err := store.LookupReportByID(ctx, svc.store, reportID) + if err != nil { + return err + } + + // - ac + if !svc.ac.CanRunReport(ctx, r) { + return ReportErrNotAllowedToRun() + } + + ss := r.Sources.ModelSteps() + ss = append(ss, r.Projections.ModelSteps()...) // Model the report model, err := rep.Model(ctx, reporters, ss...) diff --git a/system/types/report.go b/system/types/report.go index 5df8a7ff9..eee00e12a 100644 --- a/system/types/report.go +++ b/system/types/report.go @@ -81,7 +81,6 @@ type ( } ) -// @todo make better func (ss ReportDataSourceSet) ModelSteps() report.StepDefinitionSet { out := make(report.StepDefinitionSet, 0, 124) @@ -92,6 +91,16 @@ func (ss ReportDataSourceSet) ModelSteps() report.StepDefinitionSet { return out } +func (pp ReportProjectionSet) ModelSteps() report.StepDefinitionSet { + out := make(report.StepDefinitionSet, 0, 124) + + for _, p := range pp { + out = append(out, p.Sources...) + } + + return out +} + // Store stuff func (vv *ReportMeta) Scan(value interface{}) error {