Require admin on APIs to create/delete config entries from Supervisor discovery#169340
Merged
Conversation
home-assistant
Bot
added
bugfix
cla-signed
core
has-tests
integration: hassio
small-pr
Contributor
|
Hey there @home-assistant/supervisor, mind taking a look at this pull request as it has been labeled with an integration ( Code owner commandsCode owners of
|
mdegat01
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens access control for Supervisor discovery push endpoints by requiring an admin user to create or delete config entries via Hass.io discovery.
Changes:
- Add
@require_adminenforcement toPOSTandDELETE/api/hassio_push/discovery/{uuid}. - Add/extend tests to assert non-admin requests are rejected and to cover delete behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
homeassistant/components/hassio/discovery.py |
Requires admin access for discovery push create/delete endpoints. |
tests/components/hassio/test_discovery.py |
Adds tests for non-admin rejection and for delete behavior around discovery removal. |
Comment on lines
+281
to
+303
| unique_id=(uuid := uuid4()).hex, | ||
| state=config_entries.ConfigEntryState.LOADED, | ||
| source=config_entries.SOURCE_HASSIO, | ||
| ) | ||
| entry.add_to_hass(hass) | ||
|
|
||
| get_discovery_message.return_value = Discovery( | ||
| addon="mosquitto", | ||
| service="mqtt", | ||
| uuid=(uuid := uuid4()), | ||
| config={ | ||
| "broker": "mock-broker", | ||
| "port": 1883, | ||
| "username": "mock-user", | ||
| "password": "mock-pass", | ||
| "protocol": "3.1.1", | ||
| }, | ||
| ) | ||
|
|
||
| with patch.object(ConfigEntries, "async_remove") as mock_remove: | ||
| resp = await hassio_client.delete( | ||
| f"/api/hassio_push/discovery/{uuid.hex}", | ||
| json={"service": "mqtt", "uuid": uuid.hex}, |
There was a problem hiding this comment.
Use distinct variables for the config entry UUID and the discovery UUID so the test actually verifies that an existing discovery item prevents removal of the matching config entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Breaking change
An admin role is now required to use
POST /api/hassio_push/discovery/{uuid}andDELETE /api/hassio_push/discovery/{uuid}, the APIs that inform core about new discovery items in Supervisor in order to create or delete config entries.Proposed change
The APIs that Supervisor uses to inform core about the addition or removal discovery items in order to create or delete config entries now require an admin role to use.
The only input to these APIs is the UUID and service of a discovery item in Supervisor. And before processing the request it confirms with Supervisor. If Supervisor does not know about the discovery item the create call will fail. And if Supervisor still has record of a discovery item with a given UUID and service the delete call will fail. So they weren't really vulnerable to any particular spoofing but as the only intended client is Supervisor they should require admin.
When adding a new non-admin user, the UI tells the operator:
This PR is part of that audit.
Type of change
Additional information
Checklist
ruff format homeassistant tests)If user exposed functionality or configuration variables are added/changed:
If the code communicates with devices, web services, or third-party tools:
Updated and included derived files by running:
python3 -m script.hassfest.requirements_all.txt.Updated by running
python3 -m script.gen_requirements_all.To help with the load of incoming pull requests: