Security check based on request's query parameter

[Asky-GH]

Hi @aklish
Is there a possibility to get the request's query parameter to perform security checks?
For example, I have two classes:

@Include(rootLevel = true, type = "children")
public class Child {
    @Id
    private UUID id;
    private UUID parentId;
}

@Include(rootLevel = true, type = "parents")
public class Parent {
    @Id
    private UUID id;
}

and when a user performs such a request - children?filter=parentId==<id of some parent entity that doesn't belong to the user> I want to respond with 403...

[aklish]

The RequestScope implementation has the query params but the interface currently doesn't expose them:

https://github.com/yahoo/elide/blob/master/elide-core/src/main/java/com/yahoo/elide/core/RequestScope.java#L58

The interface ought to expose them. This could be a quick 5 line PR.

[aklish]

Sorry for the confusion. By five lines, I meant a very small PR (like 5ish). Your change above is similar to what I was thinking.

Another possibility (without the pom change) is to do something like:

    List<String> getQueryParameterByName(String parameterName);

This hides the underlying dependency on a javax ws Map and matches the interface for fetching headers:

    String getRequestHeaderByName(String headerName);

[Asky-GH]

By the way, I've noticed that when using OperationCheck and querying some data using filter like, for example, books?filter=title==blabla the check is being bypassed. I might be wrong but looks like a security flaw...

[aklish]

Are you referring to something like this?

GHSA-2mxr-89gf-rc4v

[Asky-GH]

Sorry, don't mind it. I was wrong.

[Brutus5000]

@aklish I have a related question: Why is Elide exposing just the security interface of the RequestScope? The life cycle hooks aren't just all about security, right? I am currently checking to put in some more business logic to it.

So I could either expand the security.RequestScope interface to whatever I need (I guess I also need query params) or swap the signature to use the "real" RequestScope.