GuoNingNing opened a new pull request, #4468: URL: https://github.com/apache/streampark/pull/4468
## Summary Seven independent authorization/IDOR fixes found and patched during a security review pass ahead of the 2.1.8 release. Each is a separate commit with a detailed message; grouped into one PR since they were all produced in the same review pass over the same release branch. - **CVE-2026-68973** — `FlinkClusterController`: `check`/`start`/`shutdown`/`delete` on `flink/cluster/*` had no `@RequiresPermissions`, letting any logged-in user start/stop/delete arbitrary Flink clusters, and letting `check()` SSRF-probe arbitrary addresses. Added `cluster:create`/`cluster:update`/`cluster:delete` permission points (seeded for team-admin). - **CVE-2026-68974** — `VariableController`: `showOriginal`/`updateVariable`/`deleteVariable` only checked role permissions, never verified the target `Variable`'s real `teamId`, and trusted client-supplied `id`/`teamId`. Added `checkTeamAccess()` re-fetching the persisted record and verifying ADMIN-or-team-membership before serving/mutating. - **CVE-2026-68972** — `ProjectController.buildLog`: validated `@PermissionScope(team = "#teamId")` against the *client-supplied* `teamId`, never cross-checked against the project's real team, allowing cross-team build-log reads (git credentials/build args). Removed the unenforceable `teamId` param; `getBuildLog` now fetches the project and checks ADMIN-or-team-membership against its persisted `teamId`. - **CVE-2026-68976** — `TeamController./team/list`: no `@RequiresPermissions`, letting any logged-in user enumerate every team on the platform. Added the (already-seeded, ADMIN-only-by-default) `team:view` permission point. - **CVE-2026-68977** — `ProxyController.proxyFlinkAssets`: no `@RequiresPermissions` while `/proxy/**` is `anon` in the Shiro filter chain, exposing the Flink/YARN reverse-proxy to unauthenticated callers. Added `app:view`, matching the sibling `proxyFlink` endpoint. Also added `checkProxyCluster()` ownership check to `proxy/cluster` (previously zero ownership checks). - **CVE-2026-68978** — `AlertController` had no `@RequiresPermissions` on any endpoint, and `AlertConfigServiceImpl` returned every user's alert configs (webhook/DingTalk/Feishu credentials) unfiltered; `FlinkEnvController` create/update/delete/sync/validity/default had no authorization either. Added ownership-scoped checks (AlertConfig has no team_id, so scoped by creator/ADMIN) and new `alert:view/add/update/delete` + `env:create/update/delete` permission points. - **CVE-2026-68975** — `/h2-console/**` was mapped to `anon` in the Shiro filter chain, so the H2 web console (raw SQL access to the whole application DB) was reachable without authentication (RCE itself already closed by `web-allow-others=false`, but console access remained open). Added `AdminOnlyFilter` requiring a valid JWT *and* `UserType.ADMIN`, mapped `/h2-console/**` to it. Also added a startup warning when the H2 datasource is left on default credentials. ## Test plan - [x] `mvn -pl streampark-console/streampark-console-service -am compile -DskipTests -o` — compiles clean - [x] `mvn -pl streampark-console/streampark-console-service -am test -Dtest=ProjectServiceImplTest -o` — all existing tests pass - [x] Verified no duplicate `t_menu`/`t_role_menu` primary keys introduced across `mysql-data.sql` / `pgsql-data.sql` / `data-h2.sql` / `upgrade/*/2.1.8.sql` - [ ] Manual verification of each endpoint against a running instance (cross-team requests denied, same-team/ADMIN requests unaffected) Co-Authored-By: Claude Sonnet 5 <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
