copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #174 from copenhagentruckwash/fix-vulnerability-in-studio-action-conditions

Browse Source 
Fix fail-open condition gating in self-serve Studio action runner
This commit is contained in:
Jeppe B
2026-06-01 20:56:21 +02:00
committed by GitHub
parent 9606d3b11d 45bfb1525a
commit 492c81e27c
2 changed files with 73 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/modules/selfserve/classes/selfserve_studio_action_runner.php
+1 -1
View File
@@ -83,7 +83,7 @@ class selfserve_studio_action_runner
continue;
}
$conditionId = $action['condition_id'];
if ($conditionId !== null && $conditionResults !== null && (($conditionResults[$conditionId] ?? false) !== true)) {
if ($conditionId !== null && (($conditionResults[$conditionId] ?? false) !== true)) {
continue;
}
$actions[] = $action;
services/nginx/app/tests/Unit/Selfserve/SelfserveStudioActionRunnerTest.php
+72
View File
@@ -0,0 +1,72 @@
<?php
app_require('modules/selfserve/classes/selfserve_studio_action_runner.php');
app_require('modules/selfserve/classes/selfserve_studio_actions.php');
use modules\selfserve\classes\selfserve_studio_action_runner;
use modules\selfserve\classes\selfserve_studio_actions;
it('does not match condition-gated actions when condition results are missing', function (): void {
$runner = new selfserve_studio_action_runner();
$lane = (object) [
'id' => 17,
'department_lane' => (object) [
'department' => new class {
public function value(): int { return 9; }
},
'machine_type_id' => new class {
public function value(): int { return 2; }
},
],
];
$config = [
'actions' => [
[
'id' => 501,
'name' => 'Open exit port when condition true',
'enabled' => true,
'event' => selfserve_studio_actions::EVENT_WASH_START_COMMAND,
'wash_mode' => selfserve_studio_actions::MODE_BOTH,
'department' => 9,
'lane' => 17,
'product' => 0,
'machine_type_id' => null,
'condition_id' => 7,
'order_priority' => 1,
'operation' => selfserve_studio_actions::OP_OPEN_LANE_EXIT_PORT,
'options' => [],
],
],
];
$missingResults = $runner->matchingActions(
$config,
$lane,
selfserve_studio_actions::EVENT_WASH_START_COMMAND,
selfserve_studio_actions::MODE_MANUAL,
[]
);
$falseResults = $runner->matchingActions(
$config,
$lane,
selfserve_studio_actions::EVENT_WASH_START_COMMAND,
selfserve_studio_actions::MODE_MANUAL,
['condition_results' => [7 => false]]
);
$trueResults = $runner->matchingActions(
$config,
$lane,
selfserve_studio_actions::EVENT_WASH_START_COMMAND,
selfserve_studio_actions::MODE_MANUAL,
['condition_results' => [7 => true]]
);
expect($missingResults)->toHaveCount(0);
expect($falseResults)->toHaveCount(0);
expect($trueResults)->toHaveCount(1);
expect($trueResults[0]['id'])->toBe(501);
});