rapidfsub

rapidfsub

Empty update action with policies?

Here is a test code about my question.
https://github.com/rapidfsub/sonet/blob/develop/test/sonet_lib/ash/policies/common_test.exs#L92

And here is a resource code about my question.
https://github.com/rapidfsub/sonet/blob/develop/test/support/lib/sonet_lib/seven_eleven/product.ex

Brief overview about my test

  • resource: Store, Inventory, Product
  • actor: Customer
  • actions:
    Store.purchase calls Inventory.purchase thru manage_relationship.
    Inventory.purchase calls Product.purchase thru manage_relationship.
  • policies:
    Store.purchase checks open and close time.
    Inventory.purchase checks inventory count.
    Product.purchase checks customer’s age.

Question

Product.purchase update action is an empty action with policies.
Even if it does nothing, but I want to check policies always.

  1. With require_atomic? false in action, always check policies.
    Without it, never check policies. Is this intended behavior?

  2. Using require_atomic? false to force policy check is weird,
    and I found access_type :strict forces policy check.
    Empty action with access_type :filter skips policy check.
    Is this intended behavior?

+ small questions (not related to content)

  1. How can I auto generate postgres schema migration? Should I write it manually?

Most Liked

zachdaniel

zachdaniel

Creator of Ash

Okay, I’ve identified the issue. It’s a very specific edge case. Its “skipping” the policy check in the case that an atomic action would induce no changes, however it’s important to note that it only does that when it is explicitly requested that no fields be updated (regardless of their initial value). So a very rare case (to call an update action that statically will not update any fields).

Aside from it being rare, I would not classify this as a security vulnerability because you can already see the record (thats how you’d be updating it in this way), and if an update were to actually happen, it would have been prevented.

Still, its confusing and problematic behavior, especially because it “presents” as if policies are being skipped, which is not a good thing.

zachdaniel

zachdaniel

Creator of Ash

Fixed in ash_postgres version 2.4.10

zachdaniel

zachdaniel

Creator of Ash

Fixed in 2.4.11 of ash_postgres.

Where Next?

Popular in Questions Top

jay1
Why is it that the mnesia database isn’t the most preferred database for use in Elixir/Phoenix?
New
stefanluptak
Hello everybody, usually, I use a 29" ultra-wide monitor for VSCode which can easily accomodate explorer (files panel) + file with code ...
New
vrod
I am using the Starship cross-shell prompt – it seems pretty nice, but I get some errors: [WARN] - (starship::utils): Executing command ...
New
belgoros
I’m not a pro in using Regex and can’t figure out why the following behaviour happens, especially if we take into account the difference ...
New
JDanielMartinez
Hi! May someone helps me, please! I have two apps into an umbrella project: the first one is Database, which manages queries, and the se...
New
script
If I have a string “1000 cfu/ml” . I want to remove the characters and / and space . So the string is like this "1000" What is the ...
New
WestKeys
Currently suffering from paralysis by [HTTP client] analysis. This is rather unusual in Elixirland as there tends to be consensus on the ...
New
openscript
Hello! Sorry for this astonishing simple question, but I’m really stuck. I try to set up the intellij-elixir plugin, but I don’t know ho...
New
PeterCarter
There are pre-rolled solutions for other frameworks that do work. However, Phoenix does not seem to have these. Have people had good expe...
New
jononomo
For some reason my phoenix channels are working for me in my local dev environment, but as soon as I deploy via Docker, I get a 403 error...
New

Other popular topics Top

Fl4m3Ph03n1x
About me? ( if you have nothing better to do than reading about some random guy in the internet :stuck_out_tongue: ) Hello all, this is ...
New
jerry
Good day to you all. I have been struggling to get a query involving like and ilike to work. Can anyone assist me on this, please? pro...
New
chrismccord
This release brings a number of exciting features, including integration with the new Phoenix LiveDashboard and Phoenix LiveView. There h...
New
hariharasudhan94
lets say i have a sample like a = 20; b = 10; if (a > b) do {:ok, "a"} end if (a < b) do {:ok, b} end if (a == b) do {:ok, "equa...
New
vonH
When I run the Plug and I recompile I wind up having to use Ctrl C to quit iex and start again. Witht the help of rlwrap I can use the cu...
New
gausby
I asked this very same question on twitter and got some interesting feedback, but I thought it would be a good question to ask here as we...
1207 39297 209
New
sergio_101
I am VERY much an elixir newbie. I have taken one elixir course and one phoenix course on Udemy. During that course, I saw the instructor...
New
romenigld
I am trying to run a deploy with docker and I successfully runned with this command: docker build -t romenigld/blog-prod . but when I t...
New
marick
I had some trouble figuring out how to make many-to-many associations work. Once I got it working, I wrote a blog post. Because I’m a nov...
New
dogweather
I wrote this comment on r/haskell, and it’s not popular there. :wink: But I think I’m on to something… Haskell reminds me of Java, and e...
New

We're in Beta

About us Mission Statement