[#1110] ir/container: Fix check of SetEACL operation

In previous implementation IR incorrectly verified `SetEACL` event of
`Container` contract. The incorrect behavior could be reproduced in two
ways:
  1. Create container using session, and perform `SetEACL` operation
  with a key that is different from the session one.
  2. Create container using session, and perform `SetEACL` w/o a
  session, but sign it using session key from the `Put` operation.

The problem was in the `checkSetEACL` validation method of IR container
processor. It always used session token used for container creation
during session ownership check.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
This commit is contained in:
Leonard Lyubich 2022-01-26 16:51:50 +03:00 committed by Alex Vanin
parent 6f338c660c
commit 20b3ff84b3

View file

@ -78,6 +78,12 @@ func (cp *Processor) checkSetEACL(e container.SetEACL) error {
} }
} }
// statement below is a little hack, but if we write token from event to container,
// checkKeyOwnership method will work just as it should:
// * tok == nil => we will check if key is a container owner's key
// * tok != nil => we will check if token was signed correctly (context is checked at the statement above)
cnr.SetSessionToken(tok)
// check key ownership // check key ownership
return cp.checkKeyOwnership(cnr, key) return cp.checkKeyOwnership(cnr, key)
} }