项目场景:
当客户申请某一项权限的时候,审核人会收到相应的邮件,里面会列出申请人的相关申请信息。
问题描述:
以下内容是终端用户给出的问题复现步骤。
I can confirm my finding. Steps to reproduce.
- User A creates request in IAM. Reason for request: TEST
- request is declined by me
- User A creates request in IAM again. Reason for request: TESTTESTTEST. 12345678
- request is approved
- email created by IAM contains ‘Reason TEST’ (reason from declined request) instead of ‘Reason TESTTESTTEST. 12345678’.
原因分析:
整体大致思路如下:
- 找到邮件模板,查看邮件模板中 order reason的定义
- 找到生成该邮件的jobchain,继续查看 order reason的定义
- 分析 order reason的定义,找到定义中有漏洞的地方(八成是查询结果没排序)并修正。
以下是分析时使用的SQL。
select * from PersonWantsOrg a where UID_Org = '1865CDC0-212E-4535-BCE4-2045F02E1B8B' and UID_PersonOrdered = '2c5c0b53-34ae-4ccb-ba5c-dfe53ec6aa29'; --这个是给出的条件
select * from DialogRichMailBody a where a.RichMailBody like '%please define a new MR SIAM incident with the following information%NEW ROLE%'; --这个是给出的邮件样例上的文字,用这个来查找试试看
select * from DialogRichMail a where a.UID_DialogRichMail = 'CCC-1cc39b10b6d94462bde136fcfd5d9917'; -- 查找到邮件模板的名称等信息
select a.JobChainName,a.XDateInserted, a.* from JobHistory a where a.BasisObjectKey like '%530220d3-873d-4626-b6ec-9cfbe332a51d%' order by a.XDateInserted desc; --8.20 第二次申请信息,希望可以找到生成邮件的jobchain
select a.JobChainName,a.XDateInserted, a.* from JobHistory a where a.GenProcID like '%4fad9273-317c-4c39-a13d-dca1ee979467%' order by a.XDateInserted desc; --8.20 通过GenProcID 来继续查找生成邮件的jobchain,通过这个条件,果然查找成功。
在这个job chain中是这样定义order reason的, 跟预先猜想的一样。
strOrderReason = Connection.GetSingleProperty("PersonWantsOrg", "OrderReason", _
f.AndRelation(f.Comparison("ObjectKeyOrdered", $FK(UID_UNSGroupB).XObjectKey$, ValType.String, CompareOperator.Equal), _
f.Comparison("UID_PersonOrdered", $FK(UID_UNSAccountB).UID_Person$, ValType.String, CompareOperator.Equal)))
解决方案:
解决方法就是定义进行修改。如下是修改以后的定义。
strOrderReason = Connection.GetSingleProperty("PersonWantsOrg", "OrderReason", _
String.Format("UID_PersonWantsOrg in (Select top 1 UID_PersonWantsOrg from PersonWantsOrg where {0} order by XDateInserted desc)", _
f.AndRelation(f.Comparison("ObjectKeyOrdered", $FK(UID_UNSGroupB).XObjectKey$, ValType.String, CompareOperator.Equal), _
f.Comparison("UID_PersonOrdered", $FK(UID_UNSAccountB).UID_Person$, ValType.String, CompareOperator.Equal))))