Conversation
Reviewer ChecklistPlease leverage this checklist to ensure your code review is thorough before approving Testing, Bugs, Errors, Logs, Documentation
System Compatibility
Quality
|
This stack of pull requests is managed by Graphite. Learn more about stacking. |
|
Implement Spanner-backed Introduces a full Rust implementation of the Key Changes• Added Affected Areas• rust/rust-sysdb/src/spanner.rs This summary was automatically generated by @propel-code-bot |
0197b36 to
ecca61f
Compare
75c2da6 to
578c9ec
Compare
ecca61f to
18a2fa3
Compare
578c9ec to
6588983
Compare
18a2fa3 to
272af49
Compare
6588983 to
8929be5
Compare
rust/spanner-migrations/migrations/0010-create_collections_lookup_index.spanner.sql
Outdated
Show resolved
Hide resolved
272af49 to
545ac09
Compare
8929be5 to
29a65f5
Compare
545ac09 to
b42abb8
Compare
e480dbb to
3fd3f10
Compare
448dadd to
9723f17
Compare
3fd3f10 to
7e28350
Compare
9723f17 to
ddb54af
Compare
7e28350 to
d2ac304
Compare
d2ac304 to
c35ebab
Compare
rust/spanner-migrations/migrations/0009-create_collections_lookup_index.spanner.sql
Show resolved
Hide resolved
c35ebab to
0ca022f
Compare
rust/spanner-migrations/migrations/0009-create_collections_lookup_index.spanner.sql
Show resolved
Hide resolved
| } | ||
|
|
||
| // Filter by tenant_id | ||
| if filter.tenant_id.is_some() { |
There was a problem hiding this comment.
[Security] Security Risk: The get_collections implementation allows executing queries without a tenant_id filter if it's missing from the request. In a multi-tenant system, this allows cross-tenant data access, potentially exposing all collections in the database.
Ensure tenant_id is mandatory or explicitly validated to be present before executing the query.
Context for Agents
Security Risk: The `get_collections` implementation allows executing queries without a `tenant_id` filter if it's missing from the request. In a multi-tenant system, this allows cross-tenant data access, potentially exposing all collections in the database.
Ensure `tenant_id` is mandatory or explicitly validated to be present before executing the query.
File: rust/rust-sysdb/src/spanner.rs
Line: 646
Description of changes
Summarize the changes made by this PR.
Test plan
How are these changes tested?
Added test
pytestfor python,yarn testfor js,cargo testfor rustMigration plan
None
Observability plan
None
Documentation Changes
None