Repository navigation
Conversation
marksvc
added this pull request to stack #4226
October 22, 2026 21:54
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## task/sec1-7 #4224 +/- ##
============================================
Coverage 81.20% 81.20%
============================================
Files 670 670
Lines 42920 42922 +2
Branches 7116 7088 -28
============================================
+ Hits 34853 34855 +2
- Misses 6902 6919 +17
+ Partials 1165 1148 -17 ☔ View full report in Codecov by Harness. |
…t there The editable properties check reads a path from each component of a client's op without establishing that there is one. The deny rule that refuses op data that is not a list of components cannot protect it, because sharedb-access runs every allow rule before any deny rule. So a client submitting a rich-text delta against a doc with editable properties made the check read a path that is not there, and the submit failed with a TypeError out of our code in place of "Permission denied". Nothing was written either way. The template matcher now accepts a path that may be missing, and matches no template to one. Such op data therefore changes no editable property, and the check denies it.
marksvc
removed this pull request from stack #4226
October 23, 2026 16:11
marksvc
added this pull request to stack #4228
October 23, 2026 16:11
marksvc
added
testing not required
ai-review-author-sign-off
marksvc
marked this pull request as ready for review
October 23, 2026 16:15
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The editable properties check reads a path from each component of a client's op
without establishing that there is one. The deny rule that refuses op data that
is not a list of components cannot protect it, because sharedb-access runs every
allow rule before any deny rule. So a client submitting a rich-text delta against
a doc with editable properties made the check read a path that is not there, and
the submit failed with a TypeError out of our code in place of "Permission
denied". Nothing was written either way.
The template matcher now accepts a path that may be missing, and matches no
template to one. Such op data therefore changes no editable property, and the
check denies it.
Open in Devin Review
Stack created with GitHub Stacks CLI • Give Feedback 💬
This change is