Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[PM-3779] idor allow the attacker to delete the victim domain #3308

Merged
merged 5 commits into from
Oct 18, 2023
Merged

[PM-3779] idor allow the attacker to delete the victim domain #3308

merged 5 commits into from
Oct 18, 2023

Conversation

r-tome
Copy link
Contributor

@r-tome r-tome commented Sep 29, 2023 •
edited by eliykat
Loading

Type of change

- [X] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ ] Other

Objective

Fix a reported defect re: deleting organization domains.

Code changes

  • src/Api/Controllers/OrganizationDomainController.cs: Simplified the process by receiving string parameters as Guid from the beginning, instead of converting them to Guid later
  • src/Core/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommand.cs: Updated the method to directly receive the object, simplifying the command's functionality to focus solely on its intended action
  • src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdAndOrganizationIdQuery.cs: Added the parameter OrganizationId to obtain a specific OrganizationDomain
  • src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQuery.cs: Added "Async" to the end of the method name to comply with naming convention
  • src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IDeleteOrganizationDomainCommand.cs: Updated the method to directly receive the object, simplifying the command's functionality to focus solely on its intended action
  • src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdQuery.cs: Added the parameter OrganizationId to obtain a specific OrganizationDomain
  • src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByOrganizationIdQuery.cs: Added "Async" to the end of the method name to comply with naming convention
  • src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IVerifyOrganizationDomainCommand.cs: Updated the method to directly receive the object, simplifying the command's functionality to focus solely on its intended action
  • src/Core/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs: Updated the method to directly receive the object, simplifying the command's functionality to focus solely on its intended action
  • src/Core/OrganizationFeatures/OrganizationServiceCollectionExtensions.cs: Updated the command name
  • src/Core/Repositories/IOrganizationDomainRepository.cs: Added method to obtain an OrganizationDomain by both Id and OrganizationId
  • src/Infrastructure.Dapper/Repositories/OrganizationDomainRepository.cs: Added method to obtain an OrganizationDomain by both Id and OrganizationId
  • src/Infrastructure.EntityFramework/Repositories/OrganizationDomainRepository.cs: Added method to obtain an OrganizationDomain by both Id and OrganizationId
  • src/Sql/dbo/Stored Procedures/OrganizationDomain_ReadByIdAndOrganizationId.sql: Stored procedure to obtain an OrganizationDomain by both Id and OrganizationId
  • test/Api.Test/Controllers/OrganizationDomainControllerTests.cs: Updated unit tests
  • test/Core.Test/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommandTests.cs: Updated unit tests
  • test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdAndOrganizationIdQueryTests.cs: Query unit tests
  • test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdQueryTests.cs: Deleted old command unit tests
  • test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQueryTests.cs: Updated method name
  • test/Core.Test/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommandTests.cs: Updated unit tests
  • util/Migrator/DbScripts/2023-09-29_00_OrgDomainReadByIdAndOrgId.sql: SQL migration script to create stored procedure

Before you submit

  • Please check for formatting errors (dotnet format --verify-no-changes) (required)
  • If making database changes - make sure you also update Entity Framework queries and/or migrations
  • Please add unit tests where it makes sense to do so (encouraged but not required)
  • If this change requires a documentation update - notify the documentation team
  • If this change has particular deployment requirements - notify the DevOps team

@r-tome
[PM-3779] Added IOrganizationDomainRepository.GetDomainByIdAndOrganiz…
a77e2b7 
…ationIdAsync and SQL stored procedure
@r-tome
[PM-3779] Changed GetOrganizationDomainByIdQuery to also take OrgId a…
c7aa9c9 
…s a parameter. Updated existing unit tests and added new. Updated controller to match command changes
@r-tome r-tome marked this pull request as ready for review September 29, 2023 14:35
@r-tome r-tome requested review from a team and vincentsalucci September 29, 2023 14:35
@bitwarden-bot
Copy link

bitwarden-bot commented Sep 29, 2023 •
edited
Loading

Logo
Checkmarx One – Scan Summary & Details – f1500637-cd3c-4fc1-82b7-598c25ad3618

New Issues

Severity Issue Source File / Package Checkmarx Insight
MEDIUM CSRF /src/Api/Controllers/OrganizationDomainController.cs: 110 Attack Vector
MEDIUM CSRF /src/Api/Controllers/OrganizationDomainController.cs: 93 Attack Vector
MEDIUM CSRF /src/Api/Controllers/OrganizationDomainController.cs: 75 Attack Vector

Fixed Issues

Severity Issue Source File / Package
MEDIUM CSRF /src/Api/Controllers/OrganizationDomainController.cs: 107
MEDIUM CSRF /src/Api/Controllers/OrganizationDomainController.cs: 95
MEDIUM CSRF /src/Api/Controllers/OrganizationDomainController.cs: 77

vincentsalucci
vincentsalucci reviewed Oct 6, 2023
View reviewed changes
src/Infrastructure.EntityFramework/Repositories/OrganizationDomainRepository.cs
var dbContext = GetDatabaseContext(scope);
var domain = await dbContext.OrganizationDomains
.Where(x => x.Id == id && x.OrganizationId == orgId)
.AsNoTracking()
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Had to do some searching to figure out what this does! TIL

@vincentsalucci
Copy link
Member

@r-tome Reviewed all of your changes but see there's a test failing. Once resolved, will green light!

@r-tome r-tome requested a review from a team as a code owner October 9, 2023 11:26
@r-tome r-tome removed the needs-qa label Oct 18, 2023
@r-tome r-tome merged commit 2121926 into master Oct 18, 2023
44 of 45 checks passed
@r-tome r-tome deleted the ac/pm-3779/idor-delete-any-domain branch October 18, 2023 10:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vincentsalucci vincentsalucci vincentsalucci approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@r-tome @bitwarden-bot @vincentsalucci