mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-19 16:02:14 +00:00
Ruben Fiszel
066d7a4726
`POST /api/w/{workspace}/jobs/run_inline/preview` ran request-supplied
code inline (in-process, e.g. DuckDB) but was missing the operator
authorization guard that its sibling `/jobs/run/preview` enforces. An
authenticated operator — the most restricted role, which must not run
preview jobs — could execute arbitrary code in a single request
(file read/write, and OS command execution via the DuckDB `shellfs`
extension when worker egress is available).
This is the incomplete-fix residual of CVE-2026-22683 / GHSA-9q9g-rp9x-244h,
whose v1.615.0 patch covered the entity-CRUD endpoints but left this
direct inline-exec sink uncovered.
Add the same `is_operator` guard from `run_preview_script`. Audited the
rest of the preview/inline arbitrary-code endpoints (run_preview_script,
run_bundle_preview_script, run_preview_flow_job, the wait_result
wrappers, run_dynamic_select inline variant, dependency jobs) — all
already carry the guard. The `run_inline_script_by_path`/`by_hash`
endpoints run deployed scripts (operator-allowed, scope-checked) and
correctly remain ungated.
Fixes WIN-2043 (GHSA-pp5h-96x3-3wqq).
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
15 lines
922 B
SQL
15 lines
922 B
SQL
-- Fixture for the inline preview authorization regression test (GHSA-pp5h-96x3-3wqq).
|
|
-- Layered on top of `base` (which provides test-workspace and the non-operator
|
|
-- `test-user-2`/SECRET_TOKEN_2). Adds an Operator member so we can assert that
|
|
-- Operators cannot reach the arbitrary-code inline preview path
|
|
-- (`POST /jobs/run_inline/preview`).
|
|
|
|
INSERT INTO password(email, password_hash, login_type, super_admin, verified, name)
|
|
VALUES ('operator@windmill.dev', 'not-a-real-hash', 'password', false, true, 'Operator User');
|
|
|
|
INSERT INTO usr(workspace_id, email, username, is_admin, operator, role) VALUES
|
|
('test-workspace', 'operator@windmill.dev', 'operator-user', false, true, 'Operator');
|
|
|
|
INSERT INTO token(token_hash, token_prefix, token, email, label, super_admin) VALUES
|
|
(encode(sha256('OPERATOR_TOKEN'::bytea), 'hex'), 'OPERATOR_T', 'OPERATOR_TOKEN', 'operator@windmill.dev', 'operator token', false);
|