From 20b3ff84b38b70871aa1c5946bffcea159a26b2d Mon Sep 17 00:00:00 2001
From: Leonard Lyubich <leonard@nspcc.ru>
Date: Wed, 26 Jan 2022 16:51:50 +0300
Subject: [PATCH] [#1110] ir/container: Fix check of `SetEACL` operation

In previous implementation IR incorrectly verified `SetEACL` event of
`Container` contract. The incorrect behavior could be reproduced in two
ways:
  1. Create container using session, and perform `SetEACL` operation
  with a key that is different from the session one.
  2. Create container using session, and perform `SetEACL` w/o a
  session, but sign it using session key from the `Put` operation.

The problem was in the `checkSetEACL` validation method of IR container
processor. It always used session token used for container creation
during session ownership check.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
---
 pkg/innerring/processors/container/process_eacl.go | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkg/innerring/processors/container/process_eacl.go b/pkg/innerring/processors/container/process_eacl.go
index 1b3064d29..432259383 100644
--- a/pkg/innerring/processors/container/process_eacl.go
+++ b/pkg/innerring/processors/container/process_eacl.go
@@ -78,6 +78,12 @@ func (cp *Processor) checkSetEACL(e container.SetEACL) error {
 		}
 	}
 
+	// statement below is a little hack, but if we write token from event to container,
+	// checkKeyOwnership method will work just as it should:
+	//  * tok == nil => we will check if key is a container owner's key
+	//  * tok != nil => we will check if token was signed correctly (context is checked at the statement above)
+	cnr.SetSessionToken(tok)
+
 	// check key ownership
 	return cp.checkKeyOwnership(cnr, key)
 }