$lib.axon.urlfile was missing a perms check for adding the nodes, part of SYN-6660 (#3490)

rakuy0 · web-flow · commit 9aa5d572420c · 2024-01-12T12:43:57.000-05:00
diff --git a/synapse/lib/stormtypes.py b/synapse/lib/stormtypes.py
@@ -2165,6 +2165,10 @@ async def wput(self, sha256, url, headers=None, params=None, method='PUT', ssl=T
         return await axon.wput(sha256byts, url, headers=headers, params=params, method=method, ssl=ssl, timeout=timeout, **kwargs)
 
     async def urlfile(self, *args, **kwargs):
+        gateiden = self.runt.snap.wlyr.iden
+        self.runt.confirm(('node', 'add', 'file:bytes'), gateiden=gateiden)
+        self.runt.confirm(('node', 'add', 'inet:urlfile'), gateiden=gateiden)
+
         resp = await self.wget(*args, **kwargs)
         code = resp.get('code')
 
diff --git a/synapse/tests/test_lib_stormtypes.py b/synapse/tests/test_lib_stormtypes.py
@@ -5764,6 +5764,11 @@ async def test_storm_lib_axon_perms(self):
 
         async with self.getTestCore() as core:
 
+            mainview = await core.callStorm('return($lib.view.get().iden)')
+            forkview = await core.callStorm('return($lib.view.get().fork().iden)')
+
+            mainlayr = core.getView(mainview).layers[0].iden
+
             visi = await core.auth.addUser('visi')
             await visi.setPasswd('secret')
 
@@ -5808,11 +5813,24 @@ async def _addfile():
 
             # urlfile
 
+            opts['view'] = mainview
             scmd = 'yield $lib.axon.urlfile($url, ssl=$lib.false) return($node)'
             await self.asyncraises(s_exc.AuthDeny, core.callStorm(scmd, opts=opts))
 
             await visi.addRule((True, ('storm', 'lib', 'axon', 'wget')))
+            await self.asyncraises(s_exc.AuthDeny, core.callStorm(scmd, opts=opts))
+
+            await visi.addRule((True, ('node', 'add', 'file:bytes')), gateiden=mainlayr)
+            await self.asyncraises(s_exc.AuthDeny, core.callStorm(scmd, opts=opts))
+
+            await visi.addRule((True, ('node', 'add', 'inet:urlfile')), gateiden=mainlayr)
             self.nn(await core.callStorm(scmd, opts=opts))
+
+            # won't work in another view
+            opts['view'] = forkview
+            await self.asyncraises(s_exc.AuthDeny, core.callStorm(scmd, opts=opts))
+            opts.pop('view')
+
             await visi.delRule((True, ('storm', 'lib', 'axon', 'wget')))
 
             await visi.addRule((True, ('axon', 'wget')))
