Extended policy checks are buggy
Unknown
Vulnerability Details
Mongoose. This issue is in the class PhabricatorPolicyFilter, lines 324, 338 and 339. The code refers to the index $key (a leftover from a previous foreach loop) where it should refer to $extended_key.
This will lead to all policy checks being skipped after $extended_objects[$key] is filtered out. I'm not sure if this has any consequences in practice, since the extended policy interface seems to have a limited use. Maybe it would be more serious having subprojects?
I can imagine a risk for the differential revisions: if any of the repositories failed to load (no idea if that can happen), the bugs in lines 338 and 339 would filter out the revision at $extended_objects[$key], and all the other revisions would then skip the checks.
Actions
View on HackerOneReport Stats
- Report ID: 109959
- State: Closed
- Substate: resolved