You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
AndHow is supposed to enforce the same scope model as Java: If code cannot 'see' the Property, it cannot access its value. The AndHow.getGroupForProperty method creates a backdoor by which application can see Properties that it wouldn't normally have access to and thus read the value of those properties. Here is an example:
publicclassMyClass {
privateStrPropMySecret....
publicStrPropPublicProp...
}
... somewhereelse ...
{
//This returns a list including MySecret, allowing access to its valueAndHow. getGroupForProperty(PublicProp).getProperties();
}
There is no reason for this method on the AndHow class - Application code never needs to know which class contained a Property and it shouldn't care.
AndHow has this method because it implements the StaticPropertyConfiguration interface. There is an internal version of this interface, so this method was moved there (StaticPropertyConfigurationInternal).
The text was updated successfully, but these errors were encountered:
eeverman
changed the title
AndHow.getGroupForProperty breaks security model and should be removed
AndHow.getGroupForProperty breaks security model by allowing GroupProxy access
Sep 28, 2021
Describe the bug
AndHow is supposed to enforce the same scope model as Java: If code cannot 'see' the Property, it cannot access its value. The
AndHow.getGroupForProperty
method creates a backdoor by which application can see Properties that it wouldn't normally have access to and thus read the value of those properties. Here is an example:There is no reason for this method on the AndHow class - Application code never needs to know which class contained a Property and it shouldn't care.
AndHow has this method because it implements the
StaticPropertyConfiguration
interface. There is an internal version of this interface, so this method was moved there (StaticPropertyConfigurationInternal
).The text was updated successfully, but these errors were encountered: