File tree Expand file tree Collapse file tree 2 files changed +14
-0
lines changed Expand file tree Collapse file tree 2 files changed +14
-0
lines changed Original file line number Diff line number Diff line change @@ -459,7 +459,9 @@ async def get_session(
459
459
460
460
storage_events = (
461
461
session_factory .query (StorageEvent )
462
+ .filter (StorageEvent .app_name == app_name )
462
463
.filter (StorageEvent .session_id == storage_session .id )
464
+ .filter (StorageEvent .user_id == user_id )
463
465
.filter (timestamp_filter )
464
466
.order_by (StorageEvent .timestamp .desc ())
465
467
.limit (
Original file line number Diff line number Diff line change @@ -126,6 +126,7 @@ async def test_session_state(service_type):
126
126
app_name = 'my_app'
127
127
user_id_1 = 'user1'
128
128
user_id_2 = 'user2'
129
+ user_id_malicious = 'malicious'
129
130
session_id_11 = 'session11'
130
131
session_id_12 = 'session12'
131
132
session_id_2 = 'session2'
@@ -148,6 +149,10 @@ async def test_session_state(service_type):
148
149
app_name = app_name , user_id = user_id_2 , session_id = session_id_2
149
150
)
150
151
152
+ await session_service .create_session (
153
+ app_name = app_name , user_id = user_id_malicious , session_id = session_id_11
154
+ )
155
+
151
156
assert session_11 .state .get ('key11' ) == 'value11'
152
157
153
158
event = Event (
@@ -196,6 +201,13 @@ async def test_session_state(service_type):
196
201
assert session_11 .state .get ('user:key1' ) == 'value1'
197
202
assert not session_11 .state .get ('temp:key' )
198
203
204
+ # Make sure a malicious user can obtain a session and events not belonging to them
205
+ session_mismatch = await session_service .get_session (
206
+ app_name = app_name , user_id = user_id_malicious , session_id = session_id_11
207
+ )
208
+
209
+ assert len (session_mismatch .events ) == 0
210
+
199
211
200
212
@pytest .mark .asyncio
201
213
@pytest .mark .parametrize (
You can’t perform that action at this time.
0 commit comments