stacklok / toolhive / 31706922139

71%

Build Type

push

github

Committed by web-flow

Commit Message

fix(authz): make Cedar URI entity IDs collision-free (#6239)

* fix(authz): make Cedar URI entity IDs collision-free

authorizeResourceRead sanitized resource URIs into Cedar entity IDs
by rewriting reserved characters to "_". The mapping is many-to-one:
"file:///etc/passwd" and "file://_etc/passwd" both became
"file____etc_passwd", and "mcp://srv/config:admin" and
"mcp://srv/config/admin" both became "mcp___srv_config_admin". A
policy grant on one entity ID therefore authorized every URI in the
collision class.

Entities are built programmatically via cedar.NewEntityUID, which
accepts any string, so no rewriting is needed. Use the exact URI as
the entity ID and drop the sanitizer. Attribute-based policies
(resource.name / resource.uri) already matched on the exact URI and
are unaffected. Policies that referenced sanitized IDs must be
updated to name the exact URI.

Added TestAuthorizeResourceReadEntityIDsCollisionFree: a grant on an
exact URI authorizes that URI and denies the URI that used to
collide with it.

Signed-off-by: Sasha Mitchell <sash.t.mitchell@gmail.com>

* docs(authz): document exact-URI Cedar resource entity IDs

Address review: docs/authz.md now shows Resource::"file:///..." form,
notes that policy IDs are exact URIs, and mentions Cedar string escaping
for " and \. Soften the authorizeResourceRead comment accordingly.

Signed-off-by: Sasha Mitchell <sash.t.mitchell@gmail.com>

---------

Signed-off-by: Sasha Mitchell <sash.t.mitchell@gmail.com>

Coverage Stats

8 of 8 new or added lines in 1 file covered. (100.0%)

66 existing lines in 3 files now uncovered.

84617 of 120401 relevant lines covered (70.28%)

98.8 hits per line