Skip to content

Conversation

@ankitpatnaik-atlan
Copy link
Collaborator

@ankitpatnaik-atlan ankitpatnaik-atlan commented Oct 8, 2025

Change description

Description here

Type of change

  • Bug fix (fixes an issue)
  • New feature (adds functionality)

Related issues

Fix #1

Helm Config Changes for Running Tests (Staging PR)

Does this PR require Helm config changes for testing?

  • Tests are NOT required for this commit. (You can proceed with the PR.) ✅
  • No, Helm config changes are not needed. (You can proceed with the PR.) ✅
  • Yes, I have already updated the config-values on enpla9up36. (You can proceed with the PR.) ✅
  • Yes, but I have NOT updated the config-values. (Please update them before proceeding; or, tests will run with default values.)⚠️

Checklists

Development

  • Lint rules pass locally
  • Application changes have been tested thoroughly
  • Automated tests covering modified code pass

Security

  • Security impact of change has been considered
  • Code follows company security practices and guidelines

Code review

  • Pull request has a descriptive title and context useful to a reviewer. Screenshots or screencasts are attached as necessary
  • "Ready for review" label attached and reviewers assigned
  • Changes have been reviewed by at least one other contributor
  • Pull request linked to task tracker where applicable

Note

Permits updates to DAAP_LINEAGE_STATUS_ATTR for archived dataProduct entities while continuing to block all other updates.

Written by Cursor Bugbot for commit 0bc318c. This will update automatically on new commits. Configure here.

@ankitpatnaik-atlan ankitpatnaik-atlan merged commit 88ab4dc into beta Oct 8, 2025
4 of 9 checks passed
}

if (!isBeingRestored) {
if (!isBeingRestored && !entity.hasAttribute(DAAP_LINEAGE_STATUS_ATTR)) {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Archived Product Update Bypass Vulnerability

The condition !entity.hasAttribute(DAAP_LINEAGE_STATUS_ATTR) in processUpdateProduct incorrectly allows any update to an archived DataProduct if DAAP_LINEAGE_STATUS_ATTR is present in the update request. This bypasses the intended archive protection, allowing modifications to other attributes beyond just the lineage status.

Fix in Cursor Fix in Web

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants