Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add mode property for restricting file upload access #19

Closed
gboyvalenkov-bosch opened this issue Jul 14, 2022 · 0 comments · Fixed by #28
Closed

Add mode property for restricting file upload access #19

gboyvalenkov-bosch opened this issue Jul 14, 2022 · 0 comments · Fixed by #28
Assignees
Labels
security Security improvement task Single unit of work
Milestone

Comments

@gboyvalenkov-bosch
Copy link
Contributor

gboyvalenkov-bosch commented Jul 14, 2022

Currently, with the dynamic configuration of uploaded files, all files readable by the upload executable can be uploaded to the cloud. This may be undesirable and unexpected behavior.

To give more control and transparency over what can be uploaded, add a mode configuration property, with the following options:

  • strict - upload is permitted only for the files specified with the files configuration property (i.e. the dynamic upload files configuration is disabled).
  • lax - no restrictions on dynamic upload (i.e. any files can be requested with the dynamic file property).
  • scoped - must be used in conjunction with the files property. Allows upload only of files matching the files glob pattern

The default mode is strict. If an attempt is made to start the upload executable, without providing the files property, it should exit with an error. The error should make it clear, that if dynamic upload is desired, the mode property should be set to lax.

@e-grigorov e-grigorov added the task Single unit of work label Jul 14, 2022
@e-grigorov e-grigorov moved this to In Progress in Eclipse Kanto Jul 14, 2022
@e-grigorov e-grigorov added this to the M2 milestone Jul 14, 2022
@e-grigorov e-grigorov linked a pull request Jul 15, 2022 that will close this issue
@e-grigorov e-grigorov moved this from In Progress to In Review in Eclipse Kanto Jul 15, 2022
Repository owner moved this from In Review to Done in Eclipse Kanto Jul 15, 2022
@e-grigorov e-grigorov added the security Security improvement label Oct 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security Security improvement task Single unit of work
Projects
Status: Done
Development

Successfully merging a pull request may close this issue.

2 participants