mirror of
https://github.com/makeplane/plane.git
synced 2026-09-01 19:48:42 +02:00
0effe3c2ae
Review catch. GenericAssetEndpoint.post deduplicates on workspace + external_source + external_id with no project scoping, and answers a match with 409 carrying asset_id and asset_url. For an attachment, asset_url also embeds the owning project and issue ids. When the body omits project_id the create-path validation is skipped entirely, so this branch is the only gate. Knowing the asset UUID is the precondition for every asset-scoped attack on this surface, so the preceding commit closed the routes that consume a foreign id while leaving the path that hands it out -- in the same handler. Two of the reports this branch addresses name this echo as their id-recovery step. Answer 404 when the matched asset's project is not accessible, and keep the 409 echo for a match the caller can reach. 404 rather than 403 deliberately: a 403 would still confirm that some asset holds this external id pair in this workspace, turning the pair into an existence oracle. The 403 used elsewhere in this branch is fine on routes where the caller already named an asset id; here they named only an external id, so a match is new information. The cost is that a caller who guesses a pair held by a project they cannot see cannot create their own asset under it -- the right trade, since real integrations mint ids per source and run as a member of the target project. Contract tests: disclosure with project_id supplied, disclosure with project_id omitted, and two controls proving dedup still echoes for a project member and for a workspace-level asset whose project_id is NULL. Verified fail-before against the previous commit -- the negative case returned 409 with the foreign asset id and its project id in asset_url. Co-authored-by: Plane AI <noreply@plane.so>