Skip to content

Use jsonrpc2.Request digest method#19845

Merged
DeividasK merged 10 commits intodevelopfrom
PRIV-217-audit-cl-79-08-request-digest-collisions
Oct 14, 2025
Merged

Use jsonrpc2.Request digest method#19845
DeividasK merged 10 commits intodevelopfrom
PRIV-217-audit-cl-79-08-request-digest-collisions

Conversation

@DeividasK
Copy link
Copy Markdown
Contributor

@DeividasK DeividasK commented Oct 10, 2025

shileiwill
shileiwill previously approved these changes Oct 10, 2025
Copy link
Copy Markdown
Contributor

@shileiwill shileiwill left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

defer r.clearExpiredAuthorizedRequests()
r.lggr.Infow("AuthorizeRequest", "method", req.Method, "requestID", req.ID)
digest, err := vaulttypes.DigestForRequest(req)
requestDigest, err := req.Digest()
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, this is the core change. we removed our customized DigestForRequest() and use the default Digest() from jsonrpc.

justinkaseman
justinkaseman previously approved these changes Oct 10, 2025
…79-08-request-digest-collisions

# Conflicts:
#	core/capabilities/vault/request_authorizer.go
#	core/capabilities/vault/request_authorizer_test.go
#	core/services/workflows/syncer/v2/workflow_syncer_v2_test.go
#	system-tests/tests/smoke/cre/v2_vault_don_test.go
pavel-raykov
pavel-raykov previously approved these changes Oct 13, 2025
Params: nil,
}
isAuthorized, _, err := auth.AuthorizeRequest(context.Background(), invalidReq)
require.ErrorContains(t, err, "unauthorized method: invalid-method")
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whether the method is valid is checked in the handler, not the authorizer.

@cl-sonarqube-production
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants