psa-systems/bunyip
Watch
9
0
Fork
You've already forked bunyip
 0
Code Issues Pull requests Projects Releases 18 Packages Wiki Activity Actions

fix(admin): reject unknown roles in the user-role change handler (BUNYIP-114) #153

Merged
vas2000-work merged 1 commit from fix/BUNYIP-114-role-enum-validation into main 2026-06-17 02:55:19 +02:00
Conversation 0 Commits 1 Files changed 1 +6
vas2000-work commented 2026-06-17 02:47:39 +02:00
Owner
Copy link

user_role forwarded f.role verbatim to the API with no enum check, so a crafted request could submit an arbitrary role string. Accept only the known roles (admin / subscriber) and redirect without calling the API otherwise.

Verified with a targeted in-container fmt + clippy on bunyip-web (TARGETED_EXIT=0). The full just check-container OOMs locally on the unrelated async-stripe dependency; Forgejo CI builds the workspace cleanly.

Fixes BUNYIP-114.

user_role forwarded f.role verbatim to the API with no enum check, so a crafted request could submit an arbitrary role string. Accept only the known roles (admin / subscriber) and redirect without calling the API otherwise. Verified with a targeted in-container fmt + clippy on bunyip-web (TARGETED_EXIT=0). The full just check-container OOMs locally on the unrelated async-stripe dependency; Forgejo CI builds the workspace cleanly. Fixes BUNYIP-114.
fix(admin): reject unknown roles in the user-role change handler
All checks were successful
Check / fmt / clippy / build / test (pull_request) Successful in 1m55s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
fb44e45e92 
user_role forwarded f.role verbatim to the API with no enum check, so a
crafted request could submit an arbitrary role string. Accept only the
known roles (admin / subscriber) and redirect without calling the API
otherwise. Verified with a targeted in-container fmt + clippy on
bunyip-web (the full check-container OOMs on the unrelated async-stripe
dependency).

#BUNYIP-114

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
vas2000-work deleted branch fix/BUNYIP-114-role-enum-validation 2026-06-17 02:55:19 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/bunyip!153
No description provided.