mirror of
https://github.com/makeplane/plane.git
synced 2026-09-02 03:59:00 +02:00
8d992aebf3
Review follow-up. The denial tests checked that the matched asset's UUIDs did not appear in the response body, which is weaker than it looks: asset_url is derived from entity_type, and its workspace-level form (/api/assets/v2/static/<id>/) carries no project id at all, so a substring check on the project UUID would not catch every shape of leak. Assert the asset_id and asset_url fields are absent outright, in a helper shared by both denial cases, and keep the UUID substring checks underneath it. The omitted-project_id case previously only checked the asset id, so it now covers the same ground as the case that supplies one. Both denial tests fail against the commit before the dedup fix; the two controls proving dedup still echoes for an accessible asset pass either way. Co-authored-by: Plane AI <noreply@plane.so>