From 2be84b5867be2027bb5085819c626dc746d50faa Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Wed, 15 Feb 2023 13:20:20 +0100 Subject: Validate the scope when validating operations Signed-off-by: Joas Schilling --- apps/workflowengine/lib/Manager.php | 13 +++- apps/workflowengine/tests/ManagerTest.php | 113 ++++++++++++++++++++++++++++-- 2 files changed, 118 insertions(+), 8 deletions(-) (limited to 'apps') diff --git a/apps/workflowengine/lib/Manager.php b/apps/workflowengine/lib/Manager.php index 34dbf507b91..8aeb588d016 100644 --- a/apps/workflowengine/lib/Manager.php +++ b/apps/workflowengine/lib/Manager.php @@ -310,7 +310,7 @@ class Manager implements IManager { string $entity, array $events ) { - $this->validateOperation($class, $name, $checks, $operation, $entity, $events); + $this->validateOperation($class, $name, $checks, $operation, $scope, $entity, $events); $this->connection->beginTransaction(); @@ -382,7 +382,7 @@ class Manager implements IManager { throw new \DomainException('Target operation not within scope'); }; $row = $this->getOperation($id); - $this->validateOperation($row['class'], $name, $checks, $operation, $entity, $events); + $this->validateOperation($row['class'], $name, $checks, $operation, $scopeContext, $entity, $events); $checkIds = []; try { @@ -482,9 +482,12 @@ class Manager implements IManager { * @param string $name * @param array[] $checks * @param string $operation + * @param ScopeContext $scope + * @param string $entity + * @param array $events * @throws \UnexpectedValueException */ - public function validateOperation($class, $name, array $checks, $operation, string $entity, array $events) { + public function validateOperation($class, $name, array $checks, $operation, ScopeContext $scope, string $entity, array $events) { try { /** @var IOperation $instance */ $instance = $this->container->query($class); @@ -496,6 +499,10 @@ class Manager implements IManager { throw new \UnexpectedValueException($this->l->t('Operation %s is invalid', [$class])); } + if (!$instance->isAvailableForScope($scope->getScope())) { + throw new \UnexpectedValueException($this->l->t('Operation %s is invalid', [$class])); + } + $this->validateEvents($entity, $events, $instance); if (count($checks) === 0) { diff --git a/apps/workflowengine/tests/ManagerTest.php b/apps/workflowengine/tests/ManagerTest.php index 612495a5b6d..6fb65f43373 100644 --- a/apps/workflowengine/tests/ManagerTest.php +++ b/apps/workflowengine/tests/ManagerTest.php @@ -288,11 +288,20 @@ class ManagerTest extends TestCase { $userScope = $this->buildScope('jackie'); $entity = File::class; + $operationMock = $this->createMock(IOperation::class); + $operationMock->expects($this->any()) + ->method('isAvailableForScope') + ->withConsecutive( + [IManager::SCOPE_ADMIN], + [IManager::SCOPE_USER] + ) + ->willReturn(true); + $this->container->expects($this->any()) ->method('query') - ->willReturnCallback(function ($class) { + ->willReturnCallback(function ($class) use ($operationMock) { if (substr($class, -2) === 'Op') { - return $this->createMock(IOperation::class); + return $operationMock; } elseif ($class === File::class) { return $this->getMockBuilder(File::class) ->setConstructorArgs([ @@ -453,6 +462,16 @@ class ManagerTest extends TestCase { $entityMock = $this->createMock(IEntity::class); $eventEntityMock = $this->createMock(IEntityEvent::class); $checkMock = $this->createMock(ICheck::class); + $scopeMock = $this->createMock(ScopeContext::class); + + $scopeMock->expects($this->any()) + ->method('getScope') + ->willReturn(IManager::SCOPE_ADMIN); + + $operationMock->expects($this->once()) + ->method('isAvailableForScope') + ->with(IManager::SCOPE_ADMIN) + ->willReturn(true); $operationMock->expects($this->once()) ->method('validateOperation') @@ -489,7 +508,7 @@ class ManagerTest extends TestCase { } }); - $this->manager->validateOperation(IOperation::class, 'test', [$check], 'operationData', IEntity::class, ['MyEvent']); + $this->manager->validateOperation(IOperation::class, 'test', [$check], 'operationData', $scopeMock, IEntity::class, ['MyEvent']); } public function testValidateOperationCheckInputLengthError() { @@ -503,6 +522,16 @@ class ManagerTest extends TestCase { $entityMock = $this->createMock(IEntity::class); $eventEntityMock = $this->createMock(IEntityEvent::class); $checkMock = $this->createMock(ICheck::class); + $scopeMock = $this->createMock(ScopeContext::class); + + $scopeMock->expects($this->any()) + ->method('getScope') + ->willReturn(IManager::SCOPE_ADMIN); + + $operationMock->expects($this->once()) + ->method('isAvailableForScope') + ->with(IManager::SCOPE_ADMIN) + ->willReturn(true); $operationMock->expects($this->once()) ->method('validateOperation') @@ -540,7 +569,7 @@ class ManagerTest extends TestCase { }); try { - $this->manager->validateOperation(IOperation::class, 'test', [$check], 'operationData', IEntity::class, ['MyEvent']); + $this->manager->validateOperation(IOperation::class, 'test', [$check], 'operationData', $scopeMock, IEntity::class, ['MyEvent']); } catch (\UnexpectedValueException $e) { $this->assertSame('The provided check value is too long', $e->getMessage()); } @@ -558,6 +587,16 @@ class ManagerTest extends TestCase { $entityMock = $this->createMock(IEntity::class); $eventEntityMock = $this->createMock(IEntityEvent::class); $checkMock = $this->createMock(ICheck::class); + $scopeMock = $this->createMock(ScopeContext::class); + + $scopeMock->expects($this->any()) + ->method('getScope') + ->willReturn(IManager::SCOPE_ADMIN); + + $operationMock->expects($this->once()) + ->method('isAvailableForScope') + ->with(IManager::SCOPE_ADMIN) + ->willReturn(true); $operationMock->expects($this->never()) ->method('validateOperation'); @@ -594,9 +633,73 @@ class ManagerTest extends TestCase { }); try { - $this->manager->validateOperation(IOperation::class, 'test', [$check], $operationData, IEntity::class, ['MyEvent']); + $this->manager->validateOperation(IOperation::class, 'test', [$check], $operationData, $scopeMock, IEntity::class, ['MyEvent']); } catch (\UnexpectedValueException $e) { $this->assertSame('The provided operation data is too long', $e->getMessage()); } } + + public function testValidateOperationScopeNotAvailable() { + $check = [ + 'class' => ICheck::class, + 'operator' => 'is', + 'value' => 'barfoo', + ]; + $operationData = str_pad('', IManager::MAX_OPERATION_VALUE_BYTES + 1, 'FooBar'); + + $operationMock = $this->createMock(IOperation::class); + $entityMock = $this->createMock(IEntity::class); + $eventEntityMock = $this->createMock(IEntityEvent::class); + $checkMock = $this->createMock(ICheck::class); + $scopeMock = $this->createMock(ScopeContext::class); + + $scopeMock->expects($this->any()) + ->method('getScope') + ->willReturn(IManager::SCOPE_ADMIN); + + $operationMock->expects($this->once()) + ->method('isAvailableForScope') + ->with(IManager::SCOPE_ADMIN) + ->willReturn(false); + + $operationMock->expects($this->never()) + ->method('validateOperation'); + + $entityMock->expects($this->any()) + ->method('getEvents') + ->willReturn([$eventEntityMock]); + + $eventEntityMock->expects($this->any()) + ->method('getEventName') + ->willReturn('MyEvent'); + + $checkMock->expects($this->any()) + ->method('supportedEntities') + ->willReturn([IEntity::class]); + $checkMock->expects($this->never()) + ->method('validateCheck'); + + $this->container->expects($this->any()) + ->method('query') + ->willReturnCallback(function ($className) use ($operationMock, $entityMock, $eventEntityMock, $checkMock) { + switch ($className) { + case IOperation::class: + return $operationMock; + case IEntity::class: + return $entityMock; + case IEntityEvent::class: + return $eventEntityMock; + case ICheck::class: + return $checkMock; + default: + return $this->createMock($className); + } + }); + + try { + $this->manager->validateOperation(IOperation::class, 'test', [$check], $operationData, $scopeMock, IEntity::class, ['MyEvent']); + } catch (\UnexpectedValueException $e) { + $this->assertSame('Operation OCP\WorkflowEngine\IOperation is invalid', $e->getMessage()); + } + } } -- cgit v1.2.3 From cd4aad1ab6a99f9aaed1306e3b051a946944a648 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Wed, 15 Feb 2023 15:36:32 +0100 Subject: Also check the scope when reading operations from the database Signed-off-by: Joas Schilling --- apps/workflowengine/lib/Manager.php | 23 ++++++++++++++ apps/workflowengine/tests/ManagerTest.php | 53 +++++++++++++++++++++++++++++++ 2 files changed, 76 insertions(+) (limited to 'apps') diff --git a/apps/workflowengine/lib/Manager.php b/apps/workflowengine/lib/Manager.php index 8aeb588d016..a06b56dc208 100644 --- a/apps/workflowengine/lib/Manager.php +++ b/apps/workflowengine/lib/Manager.php @@ -189,6 +189,13 @@ class Manager implements IManager { return $scopesByOperation[$operationClass]; } + try { + /** @var IOperation $operation */ + $operation = $this->container->query($operationClass); + } catch (QueryException $e) { + return []; + } + $query = $this->connection->getQueryBuilder(); $query->selectDistinct('s.type') @@ -203,6 +210,11 @@ class Manager implements IManager { $scopesByOperation[$operationClass] = []; while ($row = $result->fetch()) { $scope = new ScopeContext($row['type'], $row['value']); + + if (!$operation->isAvailableForScope((int) $row['type'])) { + continue; + } + $scopesByOperation[$operationClass][$scope->getHash()] = $scope; } @@ -232,6 +244,17 @@ class Manager implements IManager { $this->operations[$scopeContext->getHash()] = []; while ($row = $result->fetch()) { + try { + /** @var IOperation $operation */ + $operation = $this->container->query($row['class']); + } catch (QueryException $e) { + continue; + } + + if (!$operation->isAvailableForScope((int) $row['scope_type'])) { + continue; + } + if (!isset($this->operations[$scopeContext->getHash()][$row['class']])) { $this->operations[$scopeContext->getHash()][$row['class']] = []; } diff --git a/apps/workflowengine/tests/ManagerTest.php b/apps/workflowengine/tests/ManagerTest.php index 6fb65f43373..4284ef9c8c4 100644 --- a/apps/workflowengine/tests/ManagerTest.php +++ b/apps/workflowengine/tests/ManagerTest.php @@ -30,6 +30,7 @@ use OC\L10N\L10N; use OCA\WorkflowEngine\Entity\File; use OCA\WorkflowEngine\Helper\ScopeContext; use OCA\WorkflowEngine\Manager; +use OCP\AppFramework\QueryException; use OCP\EventDispatcher\IEventDispatcher; use OCP\Files\IRootFolder; use OCP\IConfig; @@ -199,6 +200,32 @@ class ManagerTest extends TestCase { $userScope = $this->buildScope('jackie'); $entity = File::class; + $adminOperation = $this->createMock(IOperation::class); + $adminOperation->expects($this->any()) + ->method('isAvailableForScope') + ->willReturnMap([ + [IManager::SCOPE_ADMIN, true], + [IManager::SCOPE_USER, false], + ]); + $userOperation = $this->createMock(IOperation::class); + $userOperation->expects($this->any()) + ->method('isAvailableForScope') + ->willReturnMap([ + [IManager::SCOPE_ADMIN, false], + [IManager::SCOPE_USER, true], + ]); + + $this->container->expects($this->any()) + ->method('query') + ->willReturnCallback(function ($className) use ($adminOperation, $userOperation) { + switch ($className) { + case 'OCA\WFE\TestAdminOp': + return $adminOperation; + case 'OCA\WFE\TestUserOp': + return $userOperation; + } + }); + $opId1 = $this->invokePrivate( $this->manager, 'insertOperation', @@ -219,6 +246,13 @@ class ManagerTest extends TestCase { ); $this->invokePrivate($this->manager, 'addScope', [$opId3, $userScope]); + $opId4 = $this->invokePrivate( + $this->manager, + 'insertOperation', + ['OCA\WFE\TestAdminOp', 'Test04', [41, 10, 4], 'NoBar', $entity, []] + ); + $this->invokePrivate($this->manager, 'addScope', [$opId4, $userScope]); + $adminOps = $this->manager->getAllOperations($adminScope); $userOps = $this->manager->getAllOperations($userScope); @@ -269,6 +303,25 @@ class ManagerTest extends TestCase { ); $this->invokePrivate($this->manager, 'addScope', [$opId5, $userScope]); + $operation = $this->createMock(IOperation::class); + $operation->expects($this->any()) + ->method('isAvailableForScope') + ->willReturnMap([ + [IManager::SCOPE_ADMIN, true], + [IManager::SCOPE_USER, true], + ]); + + $this->container->expects($this->any()) + ->method('query') + ->willReturnCallback(function ($className) use ($operation) { + switch ($className) { + case 'OCA\WFE\TestOp': + return $operation; + case 'OCA\WFE\OtherTestOp': + throw new QueryException(); + } + }); + $adminOps = $this->manager->getOperations('OCA\WFE\TestOp', $adminScope); $userOps = $this->manager->getOperations('OCA\WFE\TestOp', $userScope); -- cgit v1.2.3