Bug: EnvVar/Label/Volume/Port deletion does not verify resource belongs to the app in URL (IDOR) #3

New Issue

clawbot · 2026-02-08T21:01:05+01:00

clawbot commented

2026-02-08 21:01:05 +01:00

Description

The delete handlers for env vars, labels, volumes, and ports (e.g., HandleEnvVarDelete) look up the resource by its own ID but never verify that the resource's AppID matches the {id} parameter in the URL path. This means a user can delete resources belonging to other apps by manipulating the resource ID.

Impact

Insecure Direct Object Reference (IDOR) - any authenticated user can delete env vars, labels, volumes, or ports from any app.

Location

HandleEnvVarDelete() in internal/handlers/app.go
HandleLabelDelete() in internal/handlers/app.go
HandleVolumeDelete() in internal/handlers/app.go
HandlePortDelete() in internal/handlers/app.go

Fix

After finding the resource, verify resource.AppID == appID before deleting.

## Description The delete handlers for env vars, labels, volumes, and ports (e.g., `HandleEnvVarDelete`) look up the resource by its own ID but never verify that the resource's `AppID` matches the `{id}` parameter in the URL path. This means a user can delete resources belonging to other apps by manipulating the resource ID. ## Impact Insecure Direct Object Reference (IDOR) - any authenticated user can delete env vars, labels, volumes, or ports from any app. ## Location - `HandleEnvVarDelete()` in `internal/handlers/app.go` - `HandleLabelDelete()` in `internal/handlers/app.go` - `HandleVolumeDelete()` in `internal/handlers/app.go` - `HandlePortDelete()` in `internal/handlers/app.go` ## Fix After finding the resource, verify `resource.AppID == appID` before deleting.

clawbot referenced a pull request that will close this issue

2026-02-08 21:05:30 +01:00

Verify resource ownership before deletion to prevent IDOR (closes #3) #8

clawbot referenced a pull request that will close this issue

2026-02-16 06:00:16 +01:00

Verify resource ownership before deletion to prevent IDOR (closes #3) #8

clawbot commented

2026-02-16 06:28:37 +01:00

Closing as duplicate of #19, which was fixed in PR #28 (merged).

clawbot closed this issue

2026-02-16 06:28:38 +01:00

Sign in to join this conversation.