Repository navigation
Validate session routes consistently - #1797
Merged
Merged
Conversation
Formplayer resolves form sessions by primary key alone and does not check that the authenticated caller owns the session. Any authenticated user could read and attempt to modify another user's session given only its id.
Apply @ValidateSessionOwner to every route that resolves a form session by id.
Adds test to assert that every controller route that takes a SessionRequestBean carries @ValidateSessionOwner.
Every route in PUBLIC_SESSION_ALLOWED_URLS that takes a SessionRequestBean must carry the UserRestore annotation.
gherceg
marked this pull request as ready for review
October 7, 2026 20:27
dannyroberts
approved these changes
Oct 7, 2026
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #1797 +/- ##
============================================
+ Coverage 72.25% 72.34% +0.08%
- Complexity 2149 2161 +12
============================================
Files 261 262 +1
Lines 8147 8172 +25
Branches 797 802 +5
============================================
+ Hits 5887 5912 +25
Misses 1968 1968
Partials 292 292 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Technical Summary
Adds consistent validation on routes that operate on an existing form session.
Safety Assurance
Safety story
No change to normal usage, including public forms. Covered by new unit and integration tests.
Automated test coverage
SessionOwnershipAspectTest,SessionOwnershipAspectIntegrationTest,SessionOwnershipWiringTest.QA Plan
Not requesting QA.
Special deploy instructions
Rollback instructions
Review
🤖 Generated with Claude Code