Closed
Bug 1416804
Opened 8 years ago
Closed 8 years ago
Confirm that the requested diff id is connected to the revision. [API]
Categories
(Conduit :: General, enhancement)
Conduit
General
Tracking
(Not tracked)
RESOLVED
FIXED
People
(Reporter: zalun, Assigned: zalun)
References
()
Details
Attachments
(1 file)
# Overview
We can land any diff id with any revision. This is a security hole. We need to check if requested diff id belongs to the requested revision
# Plan
- create a method which will check the integrity of diff and revision
- raise an exception if diff not in the revision
- check integrity before Patch is build or at the beginning of it
- catch the exception in `post` endpoint
|
Assignee | |
Updated•8 years ago
|
Assignee: nobody → pzalewa
|
||
Comment 1•8 years ago
|
||
Comment on attachment 8927875 [details]
Patch: Check if diff is linked to the right revision
Steven MacLeod [:smacleod] has approved the revision.
https://phabricator.services.mozilla.com/D227#6130
Attachment #8927875 -
Flags: review+
|
|
Assignee | |
Updated•8 years ago
|
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•