Skip to content

Use jsonrpc2.Request digest method - #19845

Merged
DeividasK merged 10 commits into
developfrom
PRIV-217-audit-cl-79-08-request-digest-collisions
Oct 14, 2025
Merged

DeividasK merged 10 commits into
developfrom
PRIV-217-audit-cl-79-08-request-digest-collisions

Conversation

@DeividasK

@DeividasK DeividasK commented Oct 10, 2025 •

Copy link
Copy Markdown
Contributor

shileiwill
shileiwill previously approved these changes Oct 10, 2025

@shileiwill shileiwill left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

defer r.clearExpiredAuthorizedRequests()
r.lggr.Infow("AuthorizeRequest", "method", req.Method, "requestID", req.ID)
digest, err := vaulttypes.DigestForRequest(req)
requestDigest, err := req.Digest()

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, this is the core change. we removed our customized DigestForRequest() and use the default Digest() from jsonrpc.

justinkaseman
justinkaseman previously approved these changes Oct 10, 2025
…79-08-request-digest-collisions

# Conflicts:
#	core/capabilities/vault/request_authorizer.go
#	core/capabilities/vault/request_authorizer_test.go
#	core/services/workflows/syncer/v2/workflow_syncer_v2_test.go
#	system-tests/tests/smoke/cre/v2_vault_don_test.go
pavel-raykov
pavel-raykov previously approved these changes Oct 13, 2025
Params: nil,
}
isAuthorized, _, err := auth.AuthorizeRequest(context.Background(), invalidReq)
require.ErrorContains(t, err, "unauthorized method: invalid-method")

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whether the method is valid is checked in the handler, not the authorizer.

@cl-sonarqube-production

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants