Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add: validate source names in CREATE_USER and MODIFY_USER #2205

Merged
merged 4 commits into from
Jun 14, 2024

Conversation

mattmundell
Copy link
Contributor

What

Validate the auth method names that are passed to CREATE_USER and MODIFY_USER in SOURCES/SOURCE.

Why

Doing the validation is cleaner and safer because it restricts which strings end up in users.method in the db.

Example

Before this PR you could add a user with a bogus SOURCE:

$ o m m '<create_user><name>test1</name><password>test</password><sources><source>xxx</source></sources></create_user>'
<create_user_response status="201" status_text="OK, resource created" id="16751142-63b6-44bd-9f41-7559dc50d5e8"/>

and the xxx would be stored in the db:

$ o m m '<get_users user_id="16751142-63b6-44bd-9f41-7559dc50d5e8"/>'
<get_users_response status="200" status_text="OK">
  <user id="16751142-63b6-44bd-9f41-7559dc50d5e8">
    <sources>
      <source>xxx</source>
    </sources>

After the PR:

$ o m m '<create_user><name>test2</name><password>test</password><sources><source>xxx</source></sources></create_user>'
<create_user_response status="400" status_text="Error in SOURCE" />

Similar for MODIFY_USER:

$ o m m '<modify_user><name>test2</name><password modify="0"/><sources><source>yyy</source></sources></modify_user>'
<modify_user_response status="400" status_text="Error in SOURCES" />

References

Requires greenbone/gvm-libs/pull/819.

Resolves a TODO added in aacc589 in 2013.

@mattmundell mattmundell requested a review from a team as a code owner May 29, 2024 02:36
Copy link

Conventional Commits Report

Type Number
Added 1

🚀 Conventional commits found.

@a-h-abdelsalam a-h-abdelsalam merged commit 9e1e43c into main Jun 14, 2024
11 checks passed
@a-h-abdelsalam a-h-abdelsalam deleted the validate-user-method branch June 14, 2024 13:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants