Security: Notification Mark unread lacks cross-User classification #1298

Open
opened 2026-10-07 02:01:21 +00:00 by kayg · 1 comment
Owner

Severity: minor (security test coverage; no authorization bypass found).

Defensive test steps:

  1. Use origin/dev 3601719b80.
  2. Classify the new Admin feature flag ID (#1297), then run XUSER_CLASSIFY_ONLY=1 python3 tests/adversarial/xuser_matrix.py.

Expected: the Notification ID in the Mark unread route is classified as the same User-owned Inbox item used by Mark read.

Actual: the gate stops at DELETE /api/v1/notifications/inbox/{id}/read (notifications_inbox_mark_unread) because its ID has no resource class. This prevents live cross-User replays.

Evidence: artifacts/bash-security/classification-final.log. Add the Notification ID class and a regression that builds owned and absent ID requests. Use a real Inbox fixture in the existing matrix.

Severity: minor (security test coverage; no authorization bypass found). Defensive test steps: 1. Use origin/dev 3601719b80a39f712daf07b37879b22929dfffa0. 2. Classify the new Admin feature flag ID (#1297), then run `XUSER_CLASSIFY_ONLY=1 python3 tests/adversarial/xuser_matrix.py`. Expected: the Notification ID in the Mark unread route is classified as the same User-owned Inbox item used by Mark read. Actual: the gate stops at `DELETE /api/v1/notifications/inbox/{id}/read (notifications_inbox_mark_unread)` because its ID has no resource class. This prevents live cross-User replays. Evidence: artifacts/bash-security/classification-final.log. Add the Notification ID class and a regression that builds owned and absent ID requests. Use a real Inbox fixture in the existing matrix.
Author
Owner

Added the User-owned Notification ID class and strict foreign/absent-ID 404 checks, using the existing real Inbox fixture. Added a regression that builds the real-ID DELETE and the valid missing-UUID control. Classification regressions: Ran 35 tests in 2.545s; OK (the final run timing is in artifacts/bash-security/classification-final-tests.log). The complete gate now classifies 429 operations and 1206 generated entry points. Live replay is pending the local server build.

Added the User-owned Notification ID class and strict foreign/absent-ID 404 checks, using the existing real Inbox fixture. Added a regression that builds the real-ID DELETE and the valid missing-UUID control. Classification regressions: Ran 35 tests in 2.545s; OK (the final run timing is in artifacts/bash-security/classification-final-tests.log). The complete gate now classifies 429 operations and 1206 generated entry points. Live replay is pending the local server build.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1298
No description provided.