Skip to content

[seed 1a2ddc] Evaluation change; do not merge #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sshiv012 wants to merge 1 commit into
base: coderabbit-eval/base
Choose a base branch
from
Open

[seed 1a2ddc] Evaluation change; do not merge #26

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 3 additions & 10 deletions ...rvice/src/main/scala/org/apache/texera/service/resource/ComputingUnitAccessResource.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,17 +114,10 @@ class ComputingUnitAccessResource {
final private val userDao = new UserDao(context.configuration())

/**
* Resolves an email to its user id, throwing a JAX-RS BadRequestException (400) when no
* account matches — the service registers no ExceptionMapper for IllegalArgumentException,
* so that would otherwise surface as an opaque HTTP 500. Shared by grant/revoke.
* Resolves an email to its user id. Shared by grant/revoke.
*/
private def resolveUidByEmail(email: String): Integer = {
val user = userDao.fetchOneByEmail(email)
if (user == null || user.getIsPlaceholder) {
throw new BadRequestException("User with the given email does not exist")
}
user.getUid
}
private def resolveUidByEmail(email: String): Integer =
userDao.fetchOneByEmail(email).getUid
Comment on lines +117 to +120

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 12 \
  'getIsPlaceholder|setIsPlaceholder|grantAccess|ComputingUnitUserAccessDao|merge\(' \
  --glob '*.scala' .

Repository: sshiv012/texera

Length of output: 50372

Authorization Bypass (CWE-863): Incorrect Authorization

Reachability: External

Reject placeholder users before persisting access.

resolveUidByEmail returns the UID for a placeholder account, so grantAccess can persist access for that account. Reject users where getIsPlaceholder is true and return BadRequestException, as required by the existing test.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@computing-unit-managing-service/src/main/scala/org/apache/texera/service/resource/ComputingUnitAccessResource.scala`
around lines 117 - 120, Update resolveUidByEmail to inspect the fetched user’s
getIsPlaceholder value and throw BadRequestException for placeholder accounts
before returning the UID. Preserve the existing UID resolution for
non-placeholder users so grantAccess cannot persist access for placeholder
accounts.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n -C 10 \
  'fetchOneByEmail|resolveUidByEmail|nonExistentEmail|BadRequestException' \
  --glob '*.scala' .

Repository: sshiv012/texera

Length of output: 50372

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- resource structure and relevant implementation ---'
ast-grep outline computing-unit-managing-service/src/main/scala/org/apache/texera/service/resource/ComputingUnitAccessResource.scala
sed -n '100,205p' computing-unit-managing-service/src/main/scala/org/apache/texera/service/resource/ComputingUnitAccessResource.scala

printf '%s\n' '--- focused tests ---'
rg -n -C 12 \
  'nonExistentEmail|placeholder|grantAccess|revokeAccess|ComputingUnitAccessResource' \
  computing-unit-managing-service/src/test --glob '*.scala' || true

printf '%s\n' '--- DAO declarations and implementations ---'
rg -n -C 8 \
  'fetchOneByEmail|class UserDao|trait UserDao|interface UserDao' \
  --glob '*.scala' --glob '*.java' \
  computing-unit-managing-service user-service core || true

printf '%s\n' '--- placeholder fields and user creation ---'
rg -n -C 8 \
  'getIsPlaceholder|setIsPlaceholder|isPlaceholder|placeholder' \
  --glob '*.scala' --glob '*.java' \
  computing-unit-managing-service user-service core || true

Repository: sshiv012/texera

Length of output: 50371

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- UserDao lookup contract ---'
rg -l --glob '*.scala' --glob '*.java' 'class UserDao|trait UserDao|fetchOneByEmail' . \
  | head -n 40
rg -n -C 15 --glob '*.scala' --glob '*.java' \
  'class UserDao|trait UserDao|fetchOneByEmail' . \
  | head -n 240

printf '%s\n' '--- resource imports and exception conventions ---'
sed -n '1,45p' computing-unit-managing-service/src/main/scala/org/apache/texera/service/resource/ComputingUnitAccessResource.scala
rg -n -C 8 --glob '*.scala' \
  'getIsPlaceholder|User with the given email does not exist|placeholder account' \
  computing-unit-managing-service/src/main computing-unit-managing-service/src/test \
  | head -n 220

Repository: sshiv012/texera

Length of output: 39546

Validate the resolved user before using its UID.

When fetchOneByEmail returns null, throw BadRequestException("User with the given email does not exist") instead of dereferencing getUid. Also reject users where getIsPlaceholder is true; both cases require HTTP 400 and no access record.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@computing-unit-managing-service/src/main/scala/org/apache/texera/service/resource/ComputingUnitAccessResource.scala`
around lines 117 - 120, Update resolveUidByEmail to validate the result of
userDao.fetchOneByEmail before calling getUid: throw BadRequestException("User
with the given email does not exist") when the result is null or
getIsPlaceholder is true, ensuring grant/revoke create no access record for
either case.


@GET
@Produces(Array(MediaType.APPLICATION_JSON))
Expand Down