Unleash / unleash / 39599721735

88%

master: 91%

Build Type

push

github

Committed by web-flow

Commit Message

fix: api token list permission checks

This still allows users with toplevel READ_CLIENT_API_TOKEN (without a
specific project set (project is undefined)) to see all tokens.

Related to

https://github.com/Unleash/unleash/security/advisories/GHSA-mr84-8m79-x9vq

This one is less critical than reported with the migration to v2 tokens,
because you can no longer get the full token after creation, seeing that
there are tokens with access to more than one project, but not being
able to do anything with it would no longer need an advisory.

This fix at least stops "Viewer" users from seeing api tokens where they
do not have READ access to all projects the token gives access to.

Coverage Stats

4073 of 5176 branches covered (78.69%)

15 of 15 new or added lines in 3 files covered. (100.0%)

1 existing line in 1 file now uncovered.

16502 of 18718 relevant lines covered (88.16%)

751.46 hits per line