screwdriver-api 8.0.191 → 8.0.193

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/package.json +1 -1
  2. package/plugins/pipelines/caches/delete.js +21 -1
  3. package/plugins/pipelines/tokens/update.js +5 -10
  4. package/plugins/tokens/update.js +7 -10
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "screwdriver-api",
3
- "version": "8.0.191",
3
+ "version": "8.0.193",
4
4
  "description": "API server for the Screwdriver.cd service",
5
5
  "main": "index.js",
6
6
  "scripts": {
package/plugins/pipelines/caches/delete.js CHANGED
@@ -28,9 +28,10 @@ module.exports = () => ({
28
28
  },
29
29
 
30
30
  handler: async (request, h) => {
31
- const { pipelineFactory, userFactory } = request.server.app;
31
+ const { pipelineFactory, userFactory, jobFactory, eventFactory } = request.server.app;
32
32
  const { username, scmContext } = request.auth.credentials;
33
33
  const pipelineId = request.params.id;
34
+ const { scope, cacheId } = request.query;
34
35
  const { isValidToken } = request.server.plugins.pipelines;
35
36
 
36
37
  if (!isValidToken(pipelineId, request.auth.credentials)) {
@@ -55,6 +56,25 @@ module.exports = () => ({
55
56
  // Check the user's permission
56
57
  await getUserPermissions({ user, scmUri, level: 'push' });
57
58
 
59
+ // Ensure the cache resource (scope/cacheId) actually belongs to this pipeline.
60
+ // The push permission above only authorizes {id}; without this check a caller could
61
+ // delete another pipeline's cache by passing an unrelated cacheId.
62
+ let resourcePipelineId = cacheId;
63
+
64
+ if (scope === 'jobs') {
65
+ const job = await jobFactory.get(cacheId);
66
+
67
+ resourcePipelineId = job && job.pipelineId;
68
+ } else if (scope === 'events') {
69
+ const event = await eventFactory.get(cacheId);
70
+
71
+ resourcePipelineId = event && event.pipelineId;
72
+ }
73
+
74
+ if (resourcePipelineId !== pipelineId) {
75
+ throw boom.forbidden(`Cache ${scope}:${cacheId} does not belong to pipeline ${pipelineId}`);
76
+ }
77
+
58
78
  const res = await api.invoke(request);
59
79
  const statusCode = res.statusCode === 200 ? 204 : res.statusCode;
60
80
 
package/plugins/pipelines/tokens/update.js CHANGED
@@ -65,21 +65,16 @@ module.exports = () => ({
65
65
  throw boom.conflict(`Token ${match.name} already exists`);
66
66
  }
67
67
 
68
- let payloadOptions;
69
-
70
- if (request.payload && request.payload.options) {
71
- payloadOptions = request.payload.options;
72
- }
73
-
74
68
  Object.keys(request.payload).forEach(key => {
75
69
  if (key === 'options') {
76
- const hasResourceUpdates =
77
- payloadOptions.resources && Object.keys(payloadOptions.resources).length > 0;
70
+ const payloadOptions = request.payload.options || {};
71
+ const tokenOptions = token.options || {};
72
+ const hasResourceUpdates = Object.keys(payloadOptions.resources || {}).length > 0;
78
73
 
79
74
  token.options = {
80
- ...token.options,
75
+ ...tokenOptions,
81
76
  ...payloadOptions,
82
- resources: hasResourceUpdates ? payloadOptions.resources : token.options.resources
77
+ resources: hasResourceUpdates ? payloadOptions.resources : tokenOptions.resources || {}
83
78
  };
84
79
  } else {
85
80
  token[key] = request.payload[key];
package/plugins/tokens/update.js CHANGED
@@ -50,21 +50,18 @@ module.exports = () => ({
50
50
  throw boom.conflict(`Token with name ${match.name} already exists`);
51
51
  }
52
52
 
53
- let payloadOptions;
54
-
55
- if (request.payload && request.payload.options) {
56
- payloadOptions = request.payload.options;
57
- }
58
-
59
53
  Object.keys(request.payload).forEach(key => {
60
54
  if (key === 'options') {
61
- const hasResourceUpdates =
62
- payloadOptions.resources && Object.keys(payloadOptions.resources).length > 0;
55
+ const payloadOptions = request.payload.options || {};
56
+ const tokenOptions = token.options || {};
57
+ const hasResourceUpdates = Object.keys(payloadOptions.resources || {}).length > 0;
63
58
 
64
59
  token.options = {
65
- ...token.options,
60
+ ...tokenOptions,
66
61
  ...payloadOptions,
67
- resources: hasResourceUpdates ? payloadOptions.resources : token.options.resources
62
+ resources: hasResourceUpdates
63
+ ? payloadOptions.resources
64
+ : tokenOptions.resources || {}
68
65
  };
69
66
  } else {
70
67
  token[key] = request.payload[key];