httpapi: deployments handler performs duplicate status lookup for authorization #525

New issue

Open

opened 2026-08-04 11:35:28 +00:00 by the.auditor · 0 comments

the.auditor commented

2026-08-04 11:35:28 +00:00

Owner

internal/httpapi/sites.go deployments handler resolves the site owner via h.sites.Status() inside ownerScoped(), then calls h.sites.Deployments() again — two downstream calls per request, with a small TOCTOU window between them.

Context: PR #521 (internal/httpapi/sites.go:109).

Suggested fix: resolve the owner from the deployment lookup itself (e.g. Deployments returning or carrying the owner), or accept the extra call and document it.

`internal/httpapi/sites.go` `deployments` handler resolves the site owner via `h.sites.Status()` inside `ownerScoped()`, then calls `h.sites.Deployments()` again — two downstream calls per request, with a small TOCTOU window between them. Context: PR #521 (`internal/httpapi/sites.go:109`). Suggested fix: resolve the owner from the deployment lookup itself (e.g. `Deployments` returning or carrying the owner), or accept the extra call and document it.

the.auditor added the

Kind/Enhancement

Priority

Low

labels

2026-08-04 11:35:34 +00:00