Security: Enforce contextual validation of resourceLinkList in CreateCBlogAction to prevent bypassing course, session, or group access gates.

Author: AngelFQC

src/CoreBundle/Controller/Api/CreateCBlogAction.php

@@ -16,6 +16,7 @@
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Attribute\AsController;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 
 #[AsController]
 class CreateCBlogAction extends BaseResourceFileAction
@@ -42,6 +43,12 @@ public function __invoke(
             $resourceLinkList = \is_array($resourceLinkListRaw) ? $resourceLinkListRaw : [];
         }
 
+        // The `cid` (and optional `sid`/`gid`) query parameter establishes the
+        // course context that gated the security expression. Any
+        // resourceLinkList entry that points to a different context would
+        // bypass that gate, so we reject the request outright.
+        $this->assertResourceLinkListMatchesQueryContext($request, $resourceLinkList, $security);
+
         $blog = (new CBlog())
             ->setTitle($title)
             ->setBlogSubtitle($subtitle)
@@ -89,4 +96,47 @@ private function handleShortcutCreation(
             $shortcutRepository->addShortCut($blog, $currentUser, $course, $session);
         }
     }
+
+    /**
+     * @param array<int, mixed> $resourceLinkList
+     */
+    private function assertResourceLinkListMatchesQueryContext(
+        Request $request,
+        array $resourceLinkList,
+        Security $security,
+    ): void {
+        if ($security->isGranted('ROLE_ADMIN')) {
+            return;
+        }
+
+        if ([] === $resourceLinkList) {
+            return;
+        }
+
+        $queryCid = (int) $request->query->get('cid');
+        $querySid = (int) $request->query->get('sid');
+        $queryGid = (int) $request->query->get('gid');
+
+        foreach ($resourceLinkList as $entry) {
+            if (!\is_array($entry)) {
+                continue;
+            }
+
+            $entryCid = (int) ($entry['cid'] ?? 0);
+            $entrySid = (int) ($entry['sid'] ?? 0);
+            $entryGid = (int) ($entry['gid'] ?? 0);
+
+            if ($entryCid > 0 && $entryCid !== $queryCid) {
+                throw new AccessDeniedHttpException('resourceLinkList course does not match the request context.');
+            }
+
+            if ($entrySid > 0 && $entrySid !== $querySid) {
+                throw new AccessDeniedHttpException('resourceLinkList session does not match the request context.');
+            }
+
+            if ($entryGid > 0 && $entryGid !== $queryGid) {
+                throw new AccessDeniedHttpException('resourceLinkList group does not match the request context.');
+            }
+        }
+    }
 }

src/CourseBundle/Entity/CBlog.php

@@ -37,7 +37,9 @@
 #[ORM\Table(name: 'c_blog')]
 #[ApiResource(
     operations: [
-        new GetCollection(security: "is_granted('ROLE_USER')"),
+        new GetCollection(
+            security: "is_granted('ROLE_CURRENT_COURSE_STUDENT') or is_granted('ROLE_CURRENT_COURSE_SESSION_STUDENT')",
+        ),
         new Post(
             controller: CreateCBlogAction::class,
             openapi: new Operation(
@@ -65,7 +67,7 @@
                     ]),
                 ),
             ),
-            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER') or is_granted('ROLE_TEACHER')",
+            security: "is_granted('ROLE_CURRENT_COURSE_TEACHER') or is_granted('ROLE_CURRENT_COURSE_SESSION_TEACHER')",
             validationContext: ['groups' => ['Default', 'blog:write']],
             deserialize: false
         ),