[WEB-8401] fix(security): scope public Space asset mutations to the creator (GHSA-5q33-2766-fprm) by mguptahub · Pull Request #9483 · makeplane/plane

mguptahub · 2026-07-27T06:55:20Z

Summary

The public Space asset delete, restore, bulk-rebind (and patch) endpoints (apps/api/plane/space/views/asset.py) require only IsAuthenticated and scope assets to the deploy board's workspace/project — but not to created_by=request.user. Any authenticated public-site user who knew the board anchor and an asset UUID could delete or restore another user's asset, or rebind another user's comment-description assets to a caller-controlled entity_id.

EntityAssetEndpoint.post already creates assets with created_by=request.user, establishing the intended per-user boundary: a public-site user may mutate only assets they created.

Fixes GHSA-5q33-2766-fprm (CWE-862/639). Confirmed vulnerable against origin/preview @ a8e53b6ac7.

Fix

Scope every mutation to created_by=request.user (404 when the asset isn't the caller's):

EntityAssetEndpoint.patch / delete
AssetRestoreEndpoint.post (uses all_objects to reach soft-deleted rows)
EntityBulkAssetEndpoint.post (filter scoped, so foreign assets are excluded → 404)

Tests

test_space_asset_mutation_scope_app.py — attacker (different authed user) cannot delete/restore/rebind the owner's asset (404, unchanged); owner can delete their own (204). Fail-before verified; ruff clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes
- Restricted Space asset deletion, restoration, patching, and bulk reassignment to assets created by the authenticated user.
- Added explicit not-found responses when an asset doesn’t belong to the requester.
Tests
- Added contract tests covering attacker attempts to delete, restore, rebind, and patch others’ assets (all returning 404 with no changes).
- Confirmed owners can successfully delete their own assets.

…reator (GHSA-5q33-2766-fprm) The public Space asset endpoints (space/views/asset.py) require only IsAuthenticated and scoped assets to the deploy board's workspace/project but not to created_by=request.user. Any authenticated public-site user who knew the anchor and an asset UUID could delete/restore another user's asset, or rebind others' comment-description assets to a caller-controlled entity id. EntityAssetEndpoint.post already sets created_by=request.user, establishing the intended per-user boundary. Scope EntityAssetEndpoint.patch/delete, AssetRestoreEndpoint.post, and EntityBulkAssetEndpoint.post to created_by=request.user (404 when the asset isn't the caller's). Adds 4 contract tests (attacker delete/restore/rebind blocked, owner delete allowed); fail-before verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

makeplane · 2026-07-27T06:55:35Z

Linked to Plane Work Item(s)

(WEB-8401) (security) CE — Missing object authz on public Space asset mutations (delete/restore/bulk/patch) (GHSA-5q33-2766-fprm)

This comment was auto-generated by Plane

coderabbitai · 2026-07-27T06:55:40Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: afd93413-ea6d-4af8-a656-313538967322

📥 Commits

Reviewing files that changed from the base of the PR and between ddefe76 and 00b94d3.

📒 Files selected for processing (1)

apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py

🚧 Files skipped from review as they are similar to previous changes (1)

apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py

📝 Walkthrough

Walkthrough

Changes

Asset mutation ownership scoping

Layer / File(s)	Summary
Ownership-scoped asset endpoints `apps/api/plane/space/views/asset.py`	Patch, delete, restore, and bulk rebind operations now select only assets created by the authenticated user and return `404` when no matching asset exists.
Ownership scope contract coverage `apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py`	Contract tests verify attackers cannot mutate another user’s assets while owners can delete their own assets.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

makeplane/plane#9288: Modifies the same asset mutation endpoints’ lookup scoping and 404 behavior.

Suggested reviewers: dheeru0198

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically matches the security fix for scoping public Space asset mutations to the creator.
Description check	✅ Passed	The description covers the change, motivation, and tests, but it omits the template's Type of Change checklist and screenshots section.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch web-8401/space-asset-mutation-authz

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py`:
- Around line 81-129: Add a PATCH regression test to TestSpaceAssetMutationScope
using an attacker client and the asset mutation endpoint, asserting a 404
response and refreshing the asset to verify its persisted attributes remain
unchanged. Follow the existing delete, restore, and rebind tests, and use the
relevant PATCH URL/payload symbols already defined in the test module.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: af221064-40d1-42c1-bfdb-b76be700a897

📥 Commits

Reviewing files that changed from the base of the PR and between a8e53b6 and ddefe76.

📒 Files selected for processing (2)

apps/api/plane/space/views/asset.py
apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py

#9483) The suite covered delete/restore/rebind but not PATCH (also scoped to created_by=request.user). Add an attacker PATCH asserting 404 + unchanged attributes so the PATCH ownership filter can't silently regress. Fail-before verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot AI review requested due to automatic review settings July 27, 2026 06:55

mguptahub requested review from dheeru0198 and pablohashescobar as code owners July 27, 2026 06:55

Copilot AI reviewed Jul 27, 2026

coderabbitai Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py

Copilot AI review requested due to automatic review settings July 27, 2026 07:29

Copilot AI reviewed Jul 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[WEB-8401] fix(security): scope public Space asset mutations to the creator (GHSA-5q33-2766-fprm) - #9483

[WEB-8401] fix(security): scope public Space asset mutations to the creator (GHSA-5q33-2766-fprm)#9483
mguptahub wants to merge 2 commits into
previewfrom
web-8401/space-asset-mutation-authz

mguptahub commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

makeplane Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mguptahub commented Jul 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Tests

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

makeplane Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mguptahub commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading