[IGNITE-9560] Security Engine fixes and test coverage. Phase #1.

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.6
• Fix Version/s: 2.8
• Component/s: security
• Labels: vulnerability
• Assignee: Anton Vinogradov (Obsolete, actual is "av")
• Reporter: Anton Vinogradov (Obsolete, actual is "av")
• Created: 12/Sep/18 14:30
• Updated: 22/Apr/20 09:07
• Resolved: 26/Apr/19 08:43

Description

Compute and other Public API, which able to run arbitrary code at a remote node, now run it with remote node permissions.

Affected API:

• IgniteEvents,
• CQ,
• Compute,
• Services,
• Entry processor,
• Data Streamer,
• Scan Query,
• Cache load,
• Messaging,
• ...

So, the original security context now ignored at remote executions.

We have to
1) Fix Security Engine to use original Security Context at remote executions
2) Cover every securable public API (only most important list at phase #1) with appropriate tests

• API required special permissions to be executed, should be checked to require them
• Remote executions should be checked to be executed at the original Security Context

Issue Links

• is required by: IGNITE-11410 Sandbox for user-defined code
• links to: PR4922
• links to: TC_BOT_VISA