Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! 이 PR은 작곡가 생성 기능을 도입합니다. 새로운 Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This Pull Request successfully adds a composer creation API, applying validation via ComposerCreateDto, adding a bio field to the Composer entity, and restricting access to the /composers endpoint in SecurityConfig. However, there are significant security concerns regarding authorization, specifically the use of a hardcoded user ID for administrative checks and insecure binding of the User object, which could lead to privilege escalation and authentication bypass. The current admin permission check logic needs improvement to address these vulnerabilities.
| if (user.getId() != 1L) { | ||
| throw new BusinessException(CommonErrorStatus.FORBIDDEN); | ||
| } |
There was a problem hiding this comment.
The createComposer method uses a hardcoded user ID (user.getId() != 1L) for administrative checks, which is a critical security vulnerability. This brittle approach allows for easy privilege escalation, as the first registered user (ID 1) would gain admin privileges, potentially enabling an attacker to bypass authorization. It is highly recommended to implement a robust Role-Based Access Control (RBAC) system, such as adding an isAdmin() method to the User entity or utilizing Spring Security's @PreAuthorize annotation, instead of relying on hardcoded user IDs.
| if (user.getId() != 1L) { | |
| throw new BusinessException(CommonErrorStatus.FORBIDDEN); | |
| } | |
| if (!user.isAdmin()) { | |
| throw new BusinessException(CommonErrorStatus.FORBIDDEN); | |
| } |
|
|
||
| @PostMapping | ||
| @ResponseStatus(HttpStatus.CREATED) | ||
| public void createComposer(@Valid @RequestBody ComposerCreateDto dto, User user) { |
There was a problem hiding this comment.
The createComposer method accepts a User object as a parameter without the @AuthenticationPrincipal annotation. In Spring MVC, if a POJO parameter is not annotated, the framework may attempt to bind request parameters (query strings, form data) to the object's properties. An attacker could potentially exploit this by providing an id parameter in the request (e.g., POST /composers?id=1) to impersonate the administrator or other users, bypassing the intended security checks in the service layer.
Recommendation: Use the @AuthenticationPrincipal annotation to ensure that the User object is resolved exclusively from the authenticated security context.
| public void createComposer(@Valid @RequestBody ComposerCreateDto dto, User user) { | |
| public void createComposer(@Valid @RequestBody ComposerCreateDto dto, @AuthenticationPrincipal User user) { |
1 participant
Summary
POST /composers엔드포인트 추가 (201 Created)ComposerCreateDto.kt신규 생성 (koreanName, englishName, gender 필수)Composer빌더에 누락된bio필드 추가SecurityConfig:/composerspermitAll을GET으로 제한해 POST는 인증 필요Test plan
POST /composers호출 → 201POST /composers호출 → 401POST /composers호출 → 403GET /composers로 생성된 작곡가 확인