Repository navigation
fix: [stable-9.0][OCISDEV-1140] check the grant read result before the expiration - #804
Merged
Merged
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
The function ReadUserPermissions in pkg/storage/utils/decomposedfs/node/node.go checked the expiration of a grant before it checked the read error. A failed read returned a nil grant, and the check caused a nil pointer panic. - Check the expiration only when the grant read succeeds. - Return false from isGrantExpired for a nil grant. - Add the node path to the log message for a failed grant read. - Add a unit test for isGrantExpired. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Add a test for the function ReadUserPermissions in pkg/storage/utils/decomposedfs/node/node_test.go. The test stores a grant that ReadGrant cannot read. The test checks that the function does not panic and gives no permissions. - Add the license header to pkg/storage/utils/decomposedfs/node/grant_expired_test.go. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The function Unmarshal in pkg/storage/utils/ace/ace.go ignored the error from unmarshalKV and then read a field of a nil value. The function also read the first byte of an empty value. Both cases caused a panic. - Return the error when unmarshalKV fails. - Return an error for an empty value. - Add tests in pkg/storage/utils/ace/ace_test.go. - Update the changelog entry. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2403905
force-pushed
the
fix/9.0/OCISDEV-1140
branch
from
November 11, 2026 21:31
7e3343f to
adc8163
Compare
This was referenced Nov 11, 2026
fix: [stable-9.0][OCISDEV-1140] bump reva to fix a crash in the permission check
owncloud/ocis#13436
Draft
mzner
approved these changes
Nov 12, 2026
mzner
previously approved these changes
Nov 12, 2026
The function Unmarshal in pkg/storage/utils/ace/ace.go read the first character of the principal without a length check. An empty principal caused a panic. A principal with one character passed the check, and the function Grant in pkg/storage/utils/ace/ace.go then caused a panic. The function unmarshalKV in pkg/storage/utils/ace/ace.go read the value of a field without an equals sign, and this also caused a panic. - Return an error for a principal that does not have the form "<type>:<id>". - Return an error for a field without an equals sign. - Keep the full value when the value contains an equals sign. - Ignore empty fields, as the old parser did. - Add tests in pkg/storage/utils/ace/ace_test.go. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2403905
force-pushed
the
fix/9.0/OCISDEV-1140
branch
from
November 12, 2026 10:33
a08df7a to
e3b96ab
Compare
LarsJurgensen
approved these changes
Nov 12, 2026
mmattel
approved these changes
Nov 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
owncloud/ocis#13436
The storage provider could stop when it read the permissions of a user.
The function
ReadUserPermissionsinpkg/storage/utils/decomposedfs/node/node.gochecked the expiration of a grant before it checked the read error.A failed read returned a nil grant. The check then used the nil grant.
Changes
isGrantExpiredfor a nil grant.isGrantExpiredinpkg/storage/utils/decomposedfs/node/grant_expired_test.go.changelog/unreleased/bugfix-decomposedfs-nil-grant-panic.md.Checks
pkg/storage/utils/decomposedfs/nodepass.isGrantExpiredandReadGranthandle a nil grant correctly.🤖 Generated with Claude Code