dohertj2/lmxopcua
1
0
Fork 0
Code Issues 32 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(reviews): point the -003 Won't Fix at the commit that carries it

Browse Source
This commit is contained in:
Joseph Doherty
2026-08-10 08:05:21 -04:00
parent 3427370831
commit cb7096ddff
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
code-reviews/Driver.Sql.Browser/findings.md
+1 -1
View File
@@ -85,7 +85,7 @@ Three tests, of which one was RED. `AttributesAsync_prefersATimeBearingColumn_ov
**Recommendation:** No code change proposed — the surface is reached only from `/raw`, which carries `[Authorize(Policy = AdminUiPolicies.ConfigEditor)]` (Administrator or Designer), so it is already at the right authorization level. Record the trust boundary where a reviewer will see it (`docs/security.md`, alongside the other AdminUI-authenticated capabilities): a Designer can make the AdminUI host open an arbitrary outbound database connection, which is a stronger capability than "browse a configured database" reads as.
**Resolution — Won't Fix (2026-08-10):** Documented, not restricted, in `cd4b29a3`'s follow-up commit. **The mitigating control is the AdminUI page policy, and it is admin-grade.** Verified rather than assumed, because the finding's own wording ("bounded only by whichever AdminUI policy guards the browse endpoint") left it open:
**Resolution — Won't Fix (2026-08-10):** Documented, not restricted, in `34273708`. **The mitigating control is the AdminUI page policy, and it is admin-grade.** Verified rather than assumed, because the finding's own wording ("bounded only by whichever AdminUI policy guards the browse endpoint") left it open:
- The reachable surfaces are exactly two — `/raw` (`GlobalRaw.razor`) and `/uns` (`GlobalUns.razor`, via `TagConfigEditorMap` → `SqlTagConfigEditor` → `SqlAddressPickerBody`) — and **both** carry `@attribute [Authorize(Policy = AdminUiPolicies.ConfigEditor)]`, satisfied by `Administrator` or `Designer` only. `SqlAddressPickerBody` has no other consumer.
- There is **no HTTP endpoint** for browse. `IBrowserSessionService` is a scoped service resolved from those pages' Blazor circuits (`EndpointRouteBuilderExtensions` registers it and nothing maps a route), so it inherits the page policy plus the `FallbackPolicy` beneath it. Nothing here is reachable by a lesser role or anonymously.