Escape regex characters in object search pattern (#2676) #2904

robinbanbury · 2021-11-04T08:25:03Z

Add documentation.
Add tests.
Add a changelog entry.
Add your name in the contributors file.
If you changed the HTTP API, update the API_VERSION constant and add an API changelog entry in the docs
If you added a new configuration setting, update the kinto.tpl file with it.

leplatrem · 2021-11-05T12:55:57Z

kinto/core/permission/memory.py

@@ -103,7 +103,7 @@ def get_accessible_objects(self, principals, bound_permissions=None, with_childr
        else:
            for pattern, perm in bound_permissions:
                id_match = ".*" if with_children else "[^/]+"
-                regexp = re.compile(f"^{pattern.replace('*', id_match)}$")
+                regexp = re.compile(f"^{re.escape(pattern).replace('*', id_match)}$")


Good call! But I suspect that this is also escaping patterns that we use internally to match multiple objects.

I think this could be done around here instead maybe:

kinto/kinto/core/authorization.py

Lines 236 to 261 in f27fb5a

def get_permission_object_id(self, request, object_id=None):

"""Returns the permission object id for the current request.

In the nominal case, it is just the current URI without version prefix.

For plural endpoint, it is the related object URI using the specified

`object_id`.

See :meth:`kinto.core.resource.model.SharableModel` and

:meth:`kinto.core.authorization.RouteFactory.__init__`

"""

object_uri = utils.strip_uri_prefix(request.path)

if self.on_plural_endpoint and object_id is not None:

# With the current request on a plural endpoint, the object URI must

# be found out by inspecting the "plural" service and its sibling

# "object" service. (see `register_resource()`)

matchdict = {**request.matchdict, "id": object_id}

try:

object_uri = utils.instance_uri(request, self.resource_name, **matchdict)

object_uri = object_uri.replace("%2A", "*")

except KeyError:

# Maybe the resource has no single object endpoint.

# We consider that object URIs in permissions backend will

# be stored naively:

object_uri = f"{object_uri}/{object_id}"

return object_uri

leplatrem · 2022-01-05T11:27:39Z

@robinbanbury are you willing to continue to work on this?

robinbanbury · 2022-01-10T16:18:56Z

Hi @leplatrem - sorry, I thought I was going to have some more time to work on this, but haven't found time over the holidays. Unlikely I will now in the new year either, so probably better if I let this go. Apologies.

Escape regex characters in object search pattern (Kinto#2676)

ee64b4a

robinbanbury force-pushed the escape-regex-in-object-search-pattern branch from e17cdf2 to ee64b4a Compare November 4, 2021 14:08

leplatrem reviewed Nov 5, 2021

View reviewed changes

robinbanbury closed this Jan 10, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Escape regex characters in object search pattern (#2676) #2904

Escape regex characters in object search pattern (#2676) #2904

robinbanbury commented Nov 4, 2021

leplatrem Nov 5, 2021

leplatrem commented Jan 5, 2022

robinbanbury commented Jan 10, 2022

	def get_permission_object_id(self, request, object_id=None):
	"""Returns the permission object id for the current request.
	In the nominal case, it is just the current URI without version prefix.
	For plural endpoint, it is the related object URI using the specified
	`object_id`.

	See :meth:`kinto.core.resource.model.SharableModel` and
	:meth:`kinto.core.authorization.RouteFactory.__init__`
	"""
	object_uri = utils.strip_uri_prefix(request.path)

	if self.on_plural_endpoint and object_id is not None:
	# With the current request on a plural endpoint, the object URI must
	# be found out by inspecting the "plural" service and its sibling
	# "object" service. (see `register_resource()`)
	matchdict = {**request.matchdict, "id": object_id}
	try:
	object_uri = utils.instance_uri(request, self.resource_name, **matchdict)
	object_uri = object_uri.replace("%2A", "*")
	except KeyError:
	# Maybe the resource has no single object endpoint.
	# We consider that object URIs in permissions backend will
	# be stored naively:
	object_uri = f"{object_uri}/{object_id}"

	return object_uri

Escape regex characters in object search pattern (#2676) #2904

Escape regex characters in object search pattern (#2676) #2904

Conversation

robinbanbury commented Nov 4, 2021

leplatrem Nov 5, 2021

Choose a reason for hiding this comment

leplatrem commented Jan 5, 2022

robinbanbury commented Jan 10, 2022