From f244d89e56f8d860d1d55d0e9031706fc0c6f5f7 Mon Sep 17 00:00:00 2001 From: Fintan Halpenny Date: Wed, 4 Sep 2024 11:17:33 +0100 Subject: [PATCH] node: check policy before visibility In the `is_authorized` helper, the logic checks the policy and the visibility of the repository. If the policy is set to block, the function can return before getting the repository and the identity document. This improves the check, since the repository and identity document may be missing if the repository is blocked, so it would return a different error other than the expected unauthorized error. --- radicle-node/src/worker.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/radicle-node/src/worker.rs b/radicle-node/src/worker.rs index ac3f5e3b..f84e02e5 100644 --- a/radicle-node/src/worker.rs +++ b/radicle-node/src/worker.rs @@ -280,9 +280,14 @@ impl Worker { fn is_authorized(&self, remote: NodeId, rid: RepoId) -> Result<(), UploadError> { let policy = self.policies.seed_policy(&rid)?.policy; + // Check policy first, since if we're blocking then we likely don't have + // the repository. + if policy.is_block() { + return Err(UploadError::Unauthorized(remote, rid)); + } let repo = self.storage.repository(rid)?; let doc = repo.identity_doc()?; - if !doc.is_visible_to(&remote) || policy.is_block() { + if !doc.is_visible_to(&remote) { Err(UploadError::Unauthorized(remote, rid)) } else { Ok(())