From 2fdc6f34100c586a6ecd6c1ee2c6a4bdff2dc273 Mon Sep 17 00:00:00 2001 From: xingyi Date: Thu, 5 Nov 2026 16:59:43 +0800 Subject: [PATCH] [feat_1.5.x_1223][fix with DTStack Taier cross-tenant IDOR in the datasource manager API] --- .../datasource/DataSourceController.java | 4 +-- .../datasource/impl/DsInfoService.java | 28 ++++++++++++++++++- 2 files changed, 29 insertions(+), 3 deletions(-) diff --git a/taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/datasource/DataSourceController.java b/taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/datasource/DataSourceController.java index c9907b3f33..8dee193249 100644 --- a/taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/datasource/DataSourceController.java +++ b/taier-data-develop/src/main/java/com/dtstack/taier/develop/controller/datasource/DataSourceController.java @@ -102,7 +102,7 @@ public R dsDetail(@RequestBody DsInfoIdParam dsInfoIdParam) { @Override protected DsDetailVO process() throws TaierDefineException { Asserts.notNull(dsInfoIdParam.getDataInfoId(), "数据源Id不能为空"); - DsInfo dsInfo = dsInfoService.dsInfoDetail(dsInfoIdParam.getDataInfoId()); + DsInfo dsInfo = dsInfoService.dsInfoDetail(dsInfoIdParam.getDataInfoId(),dsInfoIdParam.getTenantId()); return DsDetailTransfer.INSTANCE.toInfoVO(dsInfo); } }.execute(); @@ -115,7 +115,7 @@ public R deleteById(@RequestBody DsInfoIdParam dsInfoIdParam) { @Override protected Boolean process() throws TaierDefineException { Asserts.notNull(dsInfoIdParam.getDataInfoId(), "数据源Id不能为空"); - return dsInfoService.delDsInfo(dsInfoIdParam.getDataInfoId()); + return dsInfoService.delDsInfo(dsInfoIdParam.getDataInfoId(), dsInfoIdParam.getTenantId()); } }.execute(); } diff --git a/taier-data-develop/src/main/java/com/dtstack/taier/develop/service/datasource/impl/DsInfoService.java b/taier-data-develop/src/main/java/com/dtstack/taier/develop/service/datasource/impl/DsInfoService.java index 3134e9fc8c..831133af00 100644 --- a/taier-data-develop/src/main/java/com/dtstack/taier/develop/service/datasource/impl/DsInfoService.java +++ b/taier-data-develop/src/main/java/com/dtstack/taier/develop/service/datasource/impl/DsInfoService.java @@ -165,6 +165,29 @@ public DsInfo dsInfoDetail(Long dataInfoId) { return dsInfo; } + public DsInfo dsInfoDetail(Long dataInfoId, Long tenantId) { + DsInfo dsInfo = lambdaQuery() + .eq(DsInfo::getId, dataInfoId) + .eq(DsInfo::getTenantId, tenantId) + .one(); + + if (dsInfo == null) { + throw new TaierDefineException(ErrorCode.PERMISSION_LIMIT); + } + + String dataJson = dsInfo.getDataJson(); + JSONObject dataSourceJson = DataSourceUtils.getDataSourceJson(dataJson); + if (DataSourceUtils.judgeOpenKerberos(dataJson) && null == dataSourceJson.getString(FormNames.PRINCIPAL)) { + JSONObject kerberosConfig = dataSourceJson.getJSONObject(FormNames.KERBEROS_CONFIG); + dataSourceJson.put(FormNames.PRINCIPAL, kerberosConfig.getString(FormNames.PRINCIPAL)); + } + if (DataSourceUtils.judgeOpenKerberos(dsInfo.getDataJson()) && dsInfo.getDataType().equals(DataSourceTypeEnum.KAFKA.getDataType())) { + //kafka开启了kerberos认证 + dataSourceJson.put(FormNames.AUTHENTICATION, FormNames.KERBROS); + } + return dsInfo; + } + /** * 删除一条数据源信息 * @@ -172,8 +195,11 @@ public DsInfo dsInfoDetail(Long dataInfoId) { * @return */ @Transactional(rollbackFor = Exception.class) - public Boolean delDsInfo(Long dataInfoId) { + public Boolean delDsInfo(Long dataInfoId, Long tenantId) { DsInfo dsInfo = this.getOneById(dataInfoId); + if (dsInfo == null || !Objects.equals(dsInfo.getTenantId(), tenantId)) { + throw new TaierDefineException(ErrorCode.PERMISSION_LIMIT); + } if (Objects.equals(dsInfo.getIsMeta(), 1)) { throw new TaierDefineException(ErrorCode.CAN_NOT_DEL_META_DS); }