Uploaded image for project: 'Jackrabbit Oak'
  1. Jackrabbit Oak
  2. OAK-3517

Node.addNode(String, String) may check nt-mgt-permission against the wrong node

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • None
    • 1.2.8, 1.3.9, 1.4
    • jcr
    • None

    Description

      While I was troubleshooting an issue we're having in AEM 6.1, I've noticed an "impossible" access denied exception in the logs: the user had permission to add nodes under the node in question but still got an error.

      Some testing narrowed the issue down to a difference in behavior between the following two invocations:
      someNode.getNode("child").addNode("grandchild", "nt:unstructured");
      someNode.addNode("child/grandchild", "nt:unstructured");

      As far as I can tell, both should behave identically per the JCR spec, but the second one fails if the user doesn't have node type management permission to someNode, even if they have that permission to someNode/child.

      I believe the issue is in line 283 of NodeImpl: it is checking permissions against dlg.getTree(), but it should really check against parent.getTree(), or if possible, the path of the node that's about to be created (so glob restrictions can be evaluated).

      Attachments

        Activity

          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            angela Angela Schreiber
            Csaba Varga Csaba Varga
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment