[WEB-8401] fix(security): scope public Space asset mutations to the creator by mguptahub · Pull Request #9483 · makeplane/plane

mguptahub · 2026-07-27T06:55:20Z

Summary

The public Space asset delete, restore, bulk-rebind (and patch) endpoints (apps/api/plane/space/views/asset.py) require only IsAuthenticated and scope assets to the deploy board's workspace/project — but not to created_by=request.user. Any authenticated public-site user who knew the board anchor and an asset UUID could delete or restore another user's asset, or rebind another user's comment-description assets to a caller-controlled entity_id.

EntityAssetEndpoint.post already creates assets with created_by=request.user, establishing the intended per-user boundary: a public-site user may mutate only assets they created.

Fixes WEB-8401 (CWE-862/639). Confirmed vulnerable against origin/preview @ a8e53b6ac7.

Fix

Scope every mutation to created_by=request.user (404 when the asset isn't the caller's):

EntityAssetEndpoint.patch / delete
AssetRestoreEndpoint.post (uses all_objects to reach soft-deleted rows)
EntityBulkAssetEndpoint.post (filter scoped, so foreign assets are excluded → 404)

Tests

test_space_asset_mutation_scope_app.py — attacker (different authed user) cannot delete/restore/rebind the owner's asset (404, unchanged); owner can delete their own (204). Fail-before verified; ruff clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

Bug Fixes
- Restricted Space asset deletion, restoration, editing, and bulk reassignment to assets created by the authenticated user.
- Added not-found responses when an asset doesn’t belong to the requester.
Tests
- Added coverage confirming unauthorized asset operations return 404 without changes.
- Confirmed owners can successfully delete their own assets.

…reator (GHSA-5q33-2766-fprm) The public Space asset endpoints (space/views/asset.py) require only IsAuthenticated and scoped assets to the deploy board's workspace/project but not to created_by=request.user. Any authenticated public-site user who knew the anchor and an asset UUID could delete/restore another user's asset, or rebind others' comment-description assets to a caller-controlled entity id. EntityAssetEndpoint.post already sets created_by=request.user, establishing the intended per-user boundary. Scope EntityAssetEndpoint.patch/delete, AssetRestoreEndpoint.post, and EntityBulkAssetEndpoint.post to created_by=request.user (404 when the asset isn't the caller's). Adds 4 contract tests (attacker delete/restore/rebind blocked, owner delete allowed); fail-before verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

makeplane · 2026-07-27T06:55:35Z

Linked to Plane Work Item(s)

(WEB-8401) (security) CE — Missing object authz on public Space asset mutations (delete/restore/bulk/patch) (GHSA-5q33-2766-fprm)

This comment was auto-generated by Plane

coderabbitai · 2026-07-27T06:55:40Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5e779381-d9ca-4285-b443-c8c7ea240b61

📥 Commits

Reviewing files that changed from the base of the PR and between 00b94d3 and 448367e.

📒 Files selected for processing (2)

apps/api/plane/space/views/asset.py
apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py

🚧 Files skipped from review as they are similar to previous changes (2)

apps/api/plane/space/views/asset.py
apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py

📝 Walkthrough

Walkthrough

Asset mutation endpoints now require creator ownership. Unauthorized patch, delete, restore, and bulk rebind requests return 404. Contract tests cover denied cross-user mutations and successful owner deletion.

Changes

Asset mutation ownership scoping

Layer / File(s)	Summary
Ownership-scoped asset endpoints `apps/api/plane/space/views/asset.py`	Patch, delete, restore, and bulk rebind operations now select only assets created by the authenticated user and return `404` when no matching asset exists.
Ownership scope contract coverage `apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py`	Contract tests verify denied cross-user mutations, preserved asset state, and successful owner deletion.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

makeplane/plane#9288: Modifies the same asset mutation endpoints’ lookup scoping and 404 behavior.
makeplane/plane#9442: Restricts caller-supplied asset and board IDs to the appropriate owner or project scope.
makeplane/plane#9443: Adds creator-based mutation checks and contract tests for unauthorized requests.

Suggested reviewers: dheeru0198, pablohashescobar

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 9.09% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the security fix and the affected public Space asset mutations.
Description check	✅ Passed	The description explains the vulnerability, fix, affected endpoints, issue reference, and test coverage, but omits the template headings for change type and media.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch web-8401/space-asset-mutation-authz

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py`:
- Around line 81-129: Add a PATCH regression test to TestSpaceAssetMutationScope
using an attacker client and the asset mutation endpoint, asserting a 404
response and refreshing the asset to verify its persisted attributes remain
unchanged. Follow the existing delete, restore, and rebind tests, and use the
relevant PATCH URL/payload symbols already defined in the test module.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: af221064-40d1-42c1-bfdb-b76be700a897

📥 Commits

Reviewing files that changed from the base of the PR and between a8e53b6 and ddefe76.

📒 Files selected for processing (2)

apps/api/plane/space/views/asset.py
apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py

#9483) The suite covered delete/restore/rebind but not PATCH (also scoped to created_by=request.user). Add an attacker PATCH asserting 404 + unchanged attributes so the PATCH ownership filter can't silently regress. Fail-before verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Explanations kept; only the IDs and the restated reasoning are removed. Co-authored-by: Plane AI <noreply@plane.so>

github-actions · 2026-08-07T10:31:47Z

React Doctor found 4 issues in 4 files · 1 error & 3 warnings · score 82 / 100 (Needs work) · vs preview

Errors

❌ core/components/pages/editor/editor-body.tsx:194 Server and client render different branches no-hydration-branch-on-browser-global

3 warnings

core/components/issues/issue-layouts/spreadsheet/columns/label-column.tsx

⚠️ L14 Import from a barrel file no-barrel-import

core/components/issues/peek-overview/properties.tsx

⚠️ L42 Import from a barrel file no-barrel-import

core/components/issues/workspace-draft/draft-issue-properties.tsx

⚠️ L31 Import from a barrel file no-barrel-import

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against preview to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on preview.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit 448367e. See inline comments for fixes.}

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

apps/api/plane/space/views/asset.py:243

EntityBulkAssetEndpoint.post now scopes the queryset to created_by=request.user, but it will still return 204 and update only the owned subset if the request contains a mix of owned + non-owned asset_ids. That means the endpoint can partially apply a bulk rebind while silently ignoring foreign IDs, which contradicts the PR description’s stated 404 behavior when an asset isn’t the caller’s.

Consider enforcing that all provided asset_ids resolve under the scoped filter (after de-duplication), otherwise return 404.

        # A public-site user may only rebind assets they created.
        assets = FileAsset.objects.filter(
            id__in=asset_ids,
            workspace=deploy_board.workspace,
            project_id=deploy_board.project_id,

Copilot AI lite review requested due to automatic review settings July 27, 2026 06:55

mguptahub requested review from dheeru0198 and pablohashescobar as code owners July 27, 2026 06:55

Copilot AI reviewed Jul 27, 2026

coderabbitai Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread apps/api/plane/tests/contract/app/test_space_asset_mutation_scope_app.py

Copilot AI review requested due to automatic review settings July 27, 2026 07:29

Copilot AI reviewed Jul 27, 2026

mguptahub changed the title ~~[WEB-8401] fix(security): scope public Space asset mutations to the creator (GHSA-5q33-2766-fprm)~~ [WEB-8401] fix(security): scope public Space asset mutations to the creator Aug 7, 2026

chore(security): drop advisory identifiers and shorten comments

448367e

Explanations kept; only the IDs and the restated reasoning are removed. Co-authored-by: Plane AI <noreply@plane.so>

Copilot AI review requested due to automatic review settings August 7, 2026 10:31

Copilot started reviewing on behalf of mguptahub August 7, 2026 10:31 View session

Copilot AI reviewed Aug 7, 2026

View reviewed changes

Navigation Menu

Uh oh!

[WEB-8401] fix(security): scope public Space asset mutations to the creator - #9483

[WEB-8401] fix(security): scope public Space asset mutations to the creator#9483
mguptahub wants to merge 3 commits into
previewfrom
web-8401/space-asset-mutation-authz

mguptahub commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

makeplane Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mguptahub commented Jul 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Fix

Tests

Summary by CodeRabbit

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

makeplane Bot commented Jul 27, 2026

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Aug 7, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mguptahub commented Jul 27, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading