ORM: search should return empty list when meeting a NULL many2one in the middle of the evaluation of a chained domain expression.

Bug #598454 reported by Julien Thewys
16
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Odoo Server (MOVED TO GITHUB)
Fix Released
Medium
OpenERP's Framework R&D

Bug Description

Search should return empty list when meeting a NULL many2one in the middle of the evaluation of a chained domain expression.

Given the record rule domain:
   [('employee_id.department_id.manager_id.user_id.id', '=', user.id)]
Without the patch, the domain also matches objects whose employee is not in a department, i.e. it explicitly searches for object for which 'employee_id.department_id IS NULL'.
This behavior is a security risk (potential information leakage).

I guess there could be a better way than my patch to handle this.

Related branches

Revision history for this message
Julien Thewys (julien-thewys) wrote :
summary: - Search should return empty list when meeting a NULL many2one in the
+ ORM: search should return empty list when meeting a NULL many2one in the
middle of the evaluation of a chained domain expression.
Revision history for this message
Jay Vora (Serpent Consulting Services) (jayvora) wrote :

Hi Julien,

From my point of view, no code should pass such a condition to server.

Domain has always to be trustworthy.

We have such a 'insulation' on ir_rule.py's _domain_force_get() method.

Thanks.

Changed in openobject-server:
status: New → Opinion
Revision history for this message
Frédéric (Ferme du Sart) (frederic-declercq) wrote :

The problem comes from this code in bin/osv/expression.py (lines 367-372 in 5.0.11):

            else:
                # the case for [field, 'in', []] or [left, 'not in', []]
                if operator == 'in':
                    query = '(%s.%s IS NULL)' % (table._table, left)
                else:
                    query = '(%s.%s IS NOT NULL)' % (table._table, left)

that should be replaced with:

            elif operator == 'not in':
                query = '(1=1)'

because:
- (field, 'in', []) doesn't mean that field can be NULL
- "field can be NULL" should be written: (field, 'in', [False]) or (field, '=', False)
- related fields returns wrong answer
            ie:
                account.invoice with related field 'picking_state' (picking_id,state)
                account.invoice search like [('picking_state','=','Bob Marley')] will return all invoices having no picking

Please replace part of code

Changed in openobject-server:
status: Opinion → Confirmed
Revision history for this message
Albert Cervera i Areny - http://www.NaN-tic.com (albert-nan) wrote :

I agree with Frédéric proposal. ('field','in',[]) is broken and has already provoked several grave issues in production databases to us.

Revision history for this message
Jay Vora (Serpent Consulting Services) (jayvora) wrote :

Hi Guys,

The problem on 'in' for M2O has been solved recently : https://bugs.launchpad.net/openobject-server/+bug/651999
And for M2M/O2M, we are seeking expert opinions here at https://bugs.launchpad.net/openobject-server/+bug/626806.

Thanks.

Changed in openobject-server:
assignee: nobody → OpenERP's Framework R&D (openerp-dev-framework)
importance: Undecided → Medium
milestone: 6.0 → 6.0-rc2
xrg (xrg)
Changed in openobject-server:
status: Confirmed → In Progress
xrg (xrg)
Changed in openobject-server:
status: In Progress → Fix Committed
Revision history for this message
Olivier Dony (Odoo) (odo-openerp) wrote :

The fix has landed in server revision 3178 <email address hidden>, including a basic testsuite, courtesy of xrg :-)

Changed in openobject-server:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.