8000 fix nullptr access to usermanager object (#7095) · temon/arangodb@8d88cb4 · GitHub
[go: up one dir, main page]
Skip to content

Commit 8d88cb4

Browse files
jsteemannjsteemann
authored
fix nullptr access to usermanager object (arangodb#7095)
1 parent 78af18d commit 8d88cb4

File tree

7 files changed

+41
-13
lines changed

7 files changed

+41
-13
lines changed

‎arangod/GeneralServer/AuthenticationFeature.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,10 @@ AuthenticationFeature::AuthenticationFeature(
5050
_authCache(nullptr),
5151
_authenticationUnixSockets(true),
5252
_authenticationSystemOnly(true),
53-
_authenticationTimeout(0.0),
5453
_localAuthentication(true),
55-
_jwtSecretProgramOption(""),
56-
_active(true) {
54+
_active(true),
55+
_authenticationTimeout(0.0),
56+
_jwtSecretProgramOption("") {
5757
setOptional(false);
5858
startsAfter("BasicsPhase");
5959

‎arangod/GeneralServer/AuthenticationFeature.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,11 +77,11 @@ class AuthenticationFeature final
7777
std::unique_ptr<auth::TokenCache> _authCache;
7878
bool _authenticationUnixSockets;
7979
bool _authenticationSystemOnly;
80-
double _authenticationTimeout;
8180
bool _localAuthentication;
81+
bool _active;
82+
double _authenticationTimeout;
8283

8384
std::string _jwtSecretProgramOption;
84-
bool _active;
8585

8686
static AuthenticationFeature* INSTANCE;
8787

‎arangod/GeneralServer/GeneralCommTask.cpp

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -214,7 +214,11 @@ GeneralCommTask::RequestFlow GeneralCommTask::prepareExecution(GeneralRequest& r
214214
// prevent guessing database names (issue #5030)
215215
auth::Level lvl = auth::Level::NONE;
216216
if (req.authenticated()) {
217-
lvl = _auth->userManager()->databaseAuthLevel(req.user(), req.databaseName());
217+
if (_auth->userManager() != nullptr) {
218+
lvl = _auth->userManager()->databaseAuthLevel(req.user(), req.databaseName());
219+
} else {
220+
lvl = auth::Level::RW;
221+
}
218222
}
219223
if (lvl == auth::Level::NONE) {
220224
addErrorResponse(rest::ResponseCode::UNAUTHORIZED, req.contentTypeResponse(),

‎arangod/RestHandler/RestAdminServerHandler.cpp

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,13 @@ void RestAdminServerHandler::handleMode() {
154154

155155
AuthenticationFeature* af = AuthenticationFeature::instance();
156156
if (af->isEnabled() && !_request->user().empty()) {
157-
auth::Level lvl = af->userManager()->databaseAuthLevel(_request->user(),
158-
TRI_VOC_SYSTEM_DATABASE, /*configured*/true);
157+
auth::Level lvl = auth::Level::NONE;
158+
if (af->userManager() != nullptr) {
159+
lvl = af->userManager()->databaseAuthLevel(_request->user(),
160+
TRI_VOC_SYSTEM_DATABASE, /*configured*/true);
161+
} else {
162+
lvl = auth::Level::RW;
163+
}
159164
if (lvl < auth::Level::RW) {
160165
generateError(rest::ResponseCode::FORBIDDEN, TRI_ERROR_FORBIDDEN);
161166
return;

‎arangod/RestHandler/RestShutdownHandler.cpp

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,12 @@ RestStatus RestShutdownHandler::execute() {
5252

5353
AuthenticationFeature* af = AuthenticationFeature::instance();
5454
if (af->isEnabled() && !_request->user().empty()) {
55-
auth::Level lvl = af->userManager()->databaseAuthLevel(_request->user(), "_system", /*configured*/true);
55+
auth::Level lvl = auth::Level::NONE;
56+
if (af->userManager() != nullptr) {
57+
lvl = af->userManager()->databaseAuthLevel(_request->user(), "_system", /*configured*/true);
58+
} else {
59+
lvl = auth::Level::RW;
60+
}
5661
if (lvl < auth::Level::RW) {
5762
generateError(rest::ResponseCode::FORBIDDEN, TRI_ERROR_HTTP_FORBIDDEN,
5863
"you need admin rights to trigger shutdown");

‎arangod/Utils/ExecContext.cpp

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,9 @@ ExecContext* ExecContext::create(std::string const& user,
5252
if (af->isActive()) {
5353
auth::UserManager* um = af->userManager();
5454
TRI_ASSERT(um != nullptr);
55+
if (um == nullptr) {
56+
THROW_ARANGO_EXCEPTION_MESSAGE(TRI_ERROR_INTERNAL, "unable to find userManager instance");
57+
}
5558
dbLvl = sysLvl = um->databaseAuthLevel(user, dbname);
5659
if (dbname != TRI_VOC_SYSTEM_DATABASE) {
5760
sysLvl = um->databaseAuthLevel(user, TRI_VOC_SYSTEM_DATABASE);
@@ -70,7 +73,12 @@ bool ExecContext::canUseDatabase(std::string const& db,
7073
AuthenticationFeature* af = AuthenticationFeature::instance();
7174
TRI_ASSERT(af != nullptr);
7275
if (af->isActive()) {
73-
auth::Level allowed = af->userManager()->databaseAuthLevel(_user, db);
76+
auth::UserManager* um = af->userManager();
77+
TRI_ASSERT(um != nullptr);
78+
if (um == nullptr) {
79+
THROW_ARANGO_EXCEPTION_MESSAGE(TRI_ERROR_INTERNAL, "unable to find userManager instance");
80+
}
81+
auth::Level allowed = um->databaseAuthLevel(_user, db);
7482
return requested <= allowed;
7583
}
7684
return true;
@@ -102,5 +110,8 @@ auth::Level ExecContext::collectionAuthLevel(std::string const& dbname,
102110

103111
auth::UserManager* um = af->userManager();
104112
TRI_ASSERT(um != nullptr);
113+
if (um == nullptr) {
114+
THROW_ARANGO_EXCEPTION_MESSAGE(TRI_ERROR_INTERNAL, "unable to find userManager instance");
115+
}
105116
return um->collectionAuthLevel(_user, dbname, coll);
106117
}

‎arangod/V8Server/v8-users.cpp

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -183,8 +183,12 @@ static void JS_UpdateUser(v8::FunctionCallbackInfo<v8::Value> const& args) {
183183
}
184184
}
185185

186-
AuthenticationFeature* af = AuthenticationFeature::instance();
187-
af->userManager()->updateUser(username, [&](auth::User& u) {
186+
auth::UserManager* um = AuthenticationFeature::instance()->userManager();
187+
if (um == nullptr) {
188+
TRI_V8_THROW_EXCEPTION_MESSAGE(TRI_ERROR_NOT_IMPLEMENTED,
189+
"users are not supported on this server");
190+
}
191+
um->updateUser(username, [&](auth::User& u) {
188192
if (args.Length() > 1 && args[1]->IsString()) {
189193
u.updatePassword(TRI_ObjectToString(args[1]));
190194
}
@@ -355,7 +359,6 @@ static void JS_GrantCollection(
355359
}
356360

357361
auth::UserManager* um = AuthenticationFeature::instance()->userManager();
358-
359362
if (um == nullptr) {
360363
TRI_V8_THROW_EXCEPTION_MESSAGE(TRI_ERROR_NOT_IMPLEMENTED,
361364
"user are not supported on this server");

0 commit comments

Comments
 (0)
0