Contrib.social

Specification includes disabled resources

Open on Drupal.org →
Created on 22 February 2023, over 2 years ago

Problem/Motivation

As far as I can tell the OpenAPI specification generated by this module includes paths/endpoints for resources that have been disabled.

Calling the disabled endpoint will not produce any results but it might be characterized as some form of information disclosure.

Steps to reproduce

  1. Spawn a new site with the OpenAPI Rest module and Rest UI module (for some reason this is request) on simplytest.me
  2. Go to the REST resources configuration page at /admin/config/services/rest
  3. Enable and configure the /dblog/{id}: GET resource
  4. Disable the resource
  5. Go to the OpenAPI Resources page at /admin/config/services/openapi
  6. View the REST specification
  7. Note that it includes the disabled dblog path

Note that it is important that the resource enabled/disabled is not an entity resource. If it is an entity resource it will cause an exception to be throw as reported in a separate issue.

The solution is about the same.

Proposed resolution

Filter away disabled

Remaining tasks

User interface changes

None

API changes

None

Data model changes

None

🐛 Bug report
Status

Active

Version

2.0

Component

Code

Created by

🇩🇰Denmark kasperg

Live updates comments and jobs are added and updated live.
  • Security

    It is used for security vulnerabilities which do not need a security advisory. For example, security issues in projects which do not have security advisory coverage, or forward-porting a change already disclosed in a security advisory. See Drupal’s security advisory policy for details. Be careful publicly disclosing security vulnerabilities! Use the “Report a security vulnerability” link in the project page’s sidebar. See how to report a security issue for details.

Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.71.5 2024