chaitali borole created ATLAS-5372:
--------------------------------------
Summary: Prevent cross-user overwrite in saved search create API
via caller-supplied guid
Key: ATLAS-5372
URL: https://issues.apache.org/jira/browse/ATLAS-5372
Project: Atlas
Issue Type: Improvement
Reporter: chaitali borole
Assignee: chaitali borole
*PreRequisites
Two authenticated users with permissions to use saved-search APIs (for example:
userA, userB).
*Steps
*
Login as userA and create a saved search using:
POST /api/atlas/v2/search/saved
capture the returned guid (call it G1).
Login as userB and send another create request to:
POST /api/atlas/v2/search/saved
include:
ownerName = userB
guid = G1
different name / searchParameters.
Fetch saved searches for both users:
GET /api/atlas/v2/search/saved?user=userB
GET /api/atlas/v2/search/saved?user=userA
Observed Result
The object with guid = G1 now appears under userB with updated content.
userA no longer has that saved search entry with G1.
Expected Result
Create API should not allow client-supplied guid to update an existing
saved-search object owned by another user.
POST create should either reject non-empty guid or ignore it and always create
a new object
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
