Gerrit RefControl Permission Bypass Fix

Commit Information: - Commit Hash: 0532fb876cb86bc091a91f78e6f28fff9e39ca65 - Author: Patrick Hiesel - Committer: Patrick Hiesel - Commit Date: 2020-11-02 14:30:54 +0100 - Parent Commit Hash: 33ce3f0ad6d6f17b731887517938562469b693b3 Vulnerability Description: - Fixed a misinterpretation that allowed data to be accessed through Gerrit API endpoints that should have been locked down. - Gerrit has two components for determining whether a Git ref is visible to a user: (Default)RefFilter and PermissionBackend#ForRef (e.g., RefControl). The former always returns the correct result for all refs, while the latter determines visibility based solely on Gerrit's READ permission logic. This includes all refs/heads and any other refs that are not database refs or Git tags. When queried about a database ref (e.g., refs/changes/xx/yyyyxx/meta), this component is unaware of Git tags and database refs, thus allowing access as long as the user has READ permission on any ref prefix, such as the default "read refs/ Anonymous Users". - This is problematic because it circumvents the documented behavior [1], where users should only be able to access changes to refs they are authorized to view. - The fix makes PermissionBackend#ForRef authoritative and adds tests to assert correct behavior. These tests failed before the fix, and are included to enable easy rollback to a single commit. Affected Files: - Multiple files modified, including java/com/google/gerrit/server/permissions/RefControl.java, java/com/google/gerrit/server/permissions/RefVisibilityControl.java, etc. References: - [1] Access Control Documentation Change ID**: Ic3a756cf573dd9b38e3f198ccc44899ccf65f75 The above information reveals a security vulnerability in the software and its remediation, particularly concerning potential risks in permission control and data access.

Goal Reached Thanks to every supporter — we hit 100%!

Gerrit RefControl Permission Bypass Fix