If preview and main buckets do not exist, they are created with {"write": [request.prefixed_userid]}.
If preview and main collections do not exist, they are created with {"read": (Everyone,)}.
Since permissions are inherited by default, this allows the author of the first request (bucket implicit creator) to write into the preview or main collections.
Possible fixes:
- create destination/preview buckets only with
plugin:remote-settings allowed to write
- explicitly prevent user-originated record writes to preview/destination collections managed by the signer
See https://bugzilla.mozilla.org/show_bug.cgi?id=2062151
┆Issue is synchronized with this Jira Task
If preview and main buckets do not exist, they are created with
{"write": [request.prefixed_userid]}.If preview and main collections do not exist, they are created with
{"read": (Everyone,)}.Since permissions are inherited by default, this allows the author of the first request (bucket implicit creator) to write into the preview or main collections.
Possible fixes:
plugin:remote-settingsallowed to writeSee https://bugzilla.mozilla.org/show_bug.cgi?id=2062151
┆Issue is synchronized with this Jira Task