Skip to content

Namespace ZSS storage keys per authenticated user - #139

Open
taban03 wants to merge 1 commit into
v3.x/stagingfrom
fix/zssserver_storage
Open

Namespace ZSS storage keys per authenticated user#139
taban03 wants to merge 1 commit into
v3.x/stagingfrom
fix/zssserver_storage

Conversation

@taban03

@taban03 taban03 commented Sep 8, 2026

Copy link
Copy Markdown

Proposed changes

dataService->localStorage/remoteStorage are shared by every caller of
this plugin. serveStorage bound get/set/delete directly to the raw
URL key with no ownership check, so any authenticated user could
read, overwrite, or remove another user's entry via
GET/POST/DELETE /zssStorage/.

Keys are now namespaced as ${request->username}:${key} before
reaching storageGetString/storageSetString/storageRemove.
request->username is set by the http server itself after successful
auth (session token, JWT, or client cert), never client-controlled.
Requests with no authenticated username are rejected instead of
falling back to an un-namespaced key.

This PR addresses Issue: [Link to Github issue within https://github.com/zowe/zlux/issues if any]

This PR depends upon the following PRs:

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Change in a documentation
  • Refactor the code
  • Chore, repository cleanup, updates the dependencies.
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)

PR Checklist

Please delete options that are not relevant.

  • If the changes in this PR are meant for the next release / mainline, this PR targets the "staging" branch.
  • My code follows the style guidelines of this project (see: Contributing guideline)
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • New and existing unit tests pass locally with my changes
  • video or image is included if visual changes are made
  • Relevant update to CHANGELOG.md
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works, or describe a test method below

Testing

Further comments

Signed-off-by: Andrea Tabone <andrea.tabone@broadcom.com>
@sonarqubecloud

sonarqubecloud Bot commented Sep 8, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

Status: Ready for Review

Development

Successfully merging this pull request may close these issues.

1 participant