|
| 1 | +""" |
| 2 | +RBAC registry for the ``?prefetch=`` path. |
| 3 | +
|
| 4 | +The prefetch mixins resolve a query-string field name through ``getattr`` on a |
| 5 | +model instance, find a serializer for the resolved related model, and return |
| 6 | +the serialized representation. This module allows us to specify authorization |
| 7 | +checks on the related objects when serializing. |
| 8 | +
|
| 9 | +``_Prefetcher`` filters every resolved related object through the registered |
| 10 | +queryset before serializing it. If no policy is registered for a model, the |
| 11 | +field is omitted from the response. |
| 12 | +""" |
| 13 | + |
| 14 | +from collections.abc import Callable |
| 15 | + |
| 16 | +from django.db.models import Model, Q, QuerySet |
| 17 | + |
| 18 | +from dojo.authorization.authorization import user_has_configuration_permission |
| 19 | +from dojo.models import Engagement, Finding, Notes, Test |
| 20 | + |
| 21 | +_REGISTRY: dict[type[Model], Callable[[object], QuerySet]] = {} |
| 22 | + |
| 23 | + |
| 24 | +def discard_user(func): |
| 25 | + """ |
| 26 | + Adapter for auth helpers that don't accept a ``user`` parameter -- |
| 27 | + wraps them so they can be passed to ``register()`` like any other policy. |
| 28 | + """ |
| 29 | + |
| 30 | + def wrapper(*args, user, **kwargs): |
| 31 | + return func(*args, **kwargs) |
| 32 | + |
| 33 | + return wrapper |
| 34 | + |
| 35 | + |
| 36 | +def register(model: type[Model], func: Callable, *args, **kwargs) -> None: |
| 37 | + """Register a policy for ``model``. At lookup, ``func`` is invoked as ``func(*args, user=<requesting user>, **kwargs)``.""" |
| 38 | + |
| 39 | + def policy(user): |
| 40 | + return func(*args, user=user, **kwargs) |
| 41 | + |
| 42 | + _REGISTRY[model] = policy |
| 43 | + |
| 44 | + |
| 45 | +def get_authorized_queryset(model: type[Model], user) -> QuerySet | None: |
| 46 | + """ |
| 47 | + Return the queryset of ``model`` instances visible to ``user``. |
| 48 | +
|
| 49 | + Returns ``None`` when no policy has been registered. ``_Prefetcher`` |
| 50 | + treats ``None`` as "deny" and omits the field from the response. |
| 51 | + """ |
| 52 | + if policy := _REGISTRY.get(model): |
| 53 | + return policy(user) |
| 54 | + return None |
| 55 | + |
| 56 | + |
| 57 | +def superuser_only(model: type[Model], user) -> QuerySet: |
| 58 | + """ |
| 59 | + Policy for models whose top-level ViewSet enforces ``IsSuperUser`` |
| 60 | + (strict ``request.user.is_superuser`` check). Only superusers pass. |
| 61 | + """ |
| 62 | + if user is not None and getattr(user, "is_superuser", False): |
| 63 | + return model.objects.all() |
| 64 | + return model.objects.none() |
| 65 | + |
| 66 | + |
| 67 | +def django_view_perm(model: type[Model], user) -> QuerySet: |
| 68 | + """ |
| 69 | + Policy for models whose top-level ViewSet gates on DRF's ``DjangoModelPermissions``. |
| 70 | +
|
| 71 | + Passes all superusers and any user holding ``<app_label>.view_<model_name>``. |
| 72 | + """ |
| 73 | + if user is None: |
| 74 | + return model.objects.none() |
| 75 | + perm = f"{model._meta.app_label}.view_{model._meta.model_name}" |
| 76 | + if user.has_perm(perm): |
| 77 | + return model.objects.all() |
| 78 | + return model.objects.none() |
| 79 | + |
| 80 | + |
| 81 | +def dojo_view_perm(model: type[Model], user) -> QuerySet: |
| 82 | + """ |
| 83 | + Policy for models whose top-level ViewSet gates on a DefectDojo |
| 84 | + ``BaseDjangoModelPermission`` subclass that requires GET=view. |
| 85 | +
|
| 86 | + Passes all superusers and staff users and any user holding ``<app_label>.view_<model_name>``. |
| 87 | + """ |
| 88 | + if user is None: |
| 89 | + return model.objects.none() |
| 90 | + perm = f"{model._meta.app_label}.view_{model._meta.model_name}" |
| 91 | + if user_has_configuration_permission(user, perm): |
| 92 | + return model.objects.all() |
| 93 | + return model.objects.none() |
| 94 | + |
| 95 | + |
| 96 | +def authenticated_only(model: type[Model], user) -> QuerySet: |
| 97 | + """Policy for models whose top-level ViewSet is reachable by any authenticated user.""" |
| 98 | + if user is not None and getattr(user, "is_authenticated", False): |
| 99 | + return model.objects.all() |
| 100 | + return model.objects.none() |
| 101 | + |
| 102 | + |
| 103 | +def children_via_parent(child_model, parent_model, parent_field, *, user) -> QuerySet: |
| 104 | + """ |
| 105 | + Authorize ``child_model`` by deferring to the policy registered for |
| 106 | + ``parent_model`` -- the child is visible iff the parent it points to via |
| 107 | + ``parent_field`` is visible. Used for models that don't have their own |
| 108 | + ``get_authorized_*`` helper but logically inherit authorization from a |
| 109 | + parent (e.g. ``BurpRawRequestResponse`` -> ``Finding`` via ``finding``). |
| 110 | + """ |
| 111 | + if (parent_qs := get_authorized_queryset(parent_model, user)) is not None: |
| 112 | + return child_model.objects.filter(**{f"{parent_field}__in": parent_qs}) |
| 113 | + return child_model.objects.none() |
| 114 | + |
| 115 | + |
| 116 | +def notes_policy(user) -> QuerySet: |
| 117 | + """ |
| 118 | + Authorization for the ``Notes`` model. |
| 119 | +
|
| 120 | + Allows note viewership as follows: |
| 121 | + * superuser: every note |
| 122 | + * anyone else: a note is visible iff |
| 123 | + (its attached Finding / Test / Engagement is visible to ``user``) |
| 124 | + AND (the note is non-private OR ``user`` authored it). |
| 125 | + """ |
| 126 | + if user is None: |
| 127 | + return Notes.objects.none() |
| 128 | + if getattr(user, "is_superuser", False): |
| 129 | + return Notes.objects.all() |
| 130 | + |
| 131 | + # Helper method to avoid unnecessary queryset fetching |
| 132 | + def _qs_or_none(model, u): |
| 133 | + qs = get_authorized_queryset(model, u) |
| 134 | + return model.objects.none() if qs is None else qs |
| 135 | + |
| 136 | + finding_qs = _qs_or_none(Finding, user) |
| 137 | + test_qs = _qs_or_none(Test, user) |
| 138 | + engagement_qs = _qs_or_none(Engagement, user) |
| 139 | + |
| 140 | + parent_visible = Q(finding__in=finding_qs) | Q(test__in=test_qs) | Q(engagement__in=engagement_qs) |
| 141 | + return Notes.objects.filter( |
| 142 | + parent_visible, |
| 143 | + Q(private=False) | Q(author=user), |
| 144 | + ).distinct() |
0 commit comments