dbeaver/pro#10451 Restrict configuration mode actions - #4627
Conversation
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 8 |
| Duplication | 0 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
There was a problem hiding this comment.
🟡 Changes recommended
The service proxy can throw access-denied for Object methods (e.g., toString/equals/hashCode) in configuration mode, which can break framework/logging behavior and should be fixed before merging.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR tightens server-side access control while the CloudBeaver server is in configuration mode by denying service actions by default and requiring explicit opt-in per action via a new @WebAction(configurationModeAllowed = true) flag. It updates a small set of actions needed by the configuration wizard and adds tests to validate the behavior through the service proxy.
Changes:
- Added
WebAction.configurationModeAllowed(defaultfalse) and enforced it in theWebServiceBindingBaseservice proxy. - Marked a limited set of actions in
core,auth, andadminservices as allowed in configuration mode. - Added a focused test (
ConfigurationModeAccessTest) and wired it into the CE test suite.
File summaries
| File | Description |
|---|---|
| server/test/io.cloudbeaver.test.platform/src/io/cloudbeaver/test/platform/ConfigurationModeAccessTest.java | New test coverage validating configuration-mode deny-by-default and allowlist behavior via the service proxy. |
| server/test/io.cloudbeaver.test.platform/src/io/cloudbeaver/test/platform/CEServerTestSuite.java | Adds the new test to the suite and asserts the integration test server is not in configuration mode. |
| server/bundles/io.cloudbeaver.service.auth/src/io/cloudbeaver/service/auth/DBWServiceAuth.java | Allows selected auth endpoints needed during configuration mode. |
| server/bundles/io.cloudbeaver.service.admin/src/io/cloudbeaver/service/admin/DBWServiceAdmin.java | Allows selected admin/configuration endpoints during configuration mode; updates header year. |
| server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/WebAction.java | Introduces configurationModeAllowed attribute on @WebAction. |
| server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/WebServiceBindingBase.java | Enforces configuration-mode access restriction in the service proxy invocation handler. |
| server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/core/DBWServiceCore.java | Allows configuration-mode access for a small set of core actions needed during setup. |
| server/bundles/io.cloudbeaver.server/META-INF/MANIFEST.MF | Exports io.cloudbeaver.service.core package. |
Review details
- Files reviewed: 8/8 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| public Object invoke(@NotNull Object proxy, @NotNull Method method, @Nullable Object[] args) throws Throwable { | ||
| try { | ||
| try { | ||
| WebAction webAction = method.getAnnotation(WebAction.class); | ||
| WebApplication application = getApplication(); | ||
| checkConfigurationModeAccess(webAction, application); |
Related to dbeaver/pro#10451
Summary
Testing
git diff --checkorg.apache.commons.jexlThis PR was generated with AI (OpenAI GPT-5.6-Sol).
Merging this PR must not close the related issue.