[Zope] Nasty subtle security bug

[Martijn Faassen]

Hi there,

I'm about to describe a very nasty bug that appears to exist in
different guises in at least Zope 2.1.6 and Zope 2.2.2.

The bug is nasty because it occurs under rather restricted
circumstances, so nobody else noticed it yet, but it keeps biting _me_.

The circumstances:

  * we have external method E in the root

  * we have a user defined in the root. This user has a certain role A.

  * we authenticate that user with a DTML method in root for role A.
    (so role A in this setup exists to force authentication only)

  * we give the user a local role B (or local user account with same
    username/password with that role) in a higher folder, X.

  * the external method E has security permissions to only work
    with role B (and manager), not with anonymous.

As far as I am aware, our user should be able to execute E in the context
of X and any subfolders, as the user has the right role there. Our user
should not be able to execute E in the context of any other folder, however.
(the execution happens through a DTML call)

The symptoms:

In Zope 2.1.6, the user cannot execute the external method E. Instead, the
user is asked to reauthenticate. Naturally, reauthenticating the user again
as himself won't work.

In Zope 2.2.2, the user cannot execute the external method E either. Instead,
the calling DTML code raises a NameError, basically saying our external
method does not exist.

The subtle bits -- when it *does* work fine --:

This is probably why nobody actually ran into this one before.

  * it works fine when the user has manager role (at least in root)

  *  it works fine when the external method is executable by anonymous.

  * it works fine when the external method is defined in another folder
    (not root folder)

  * it works fine with DTML methods

  * it even works fine (tested in 2.1.6) when the role is *not* added as 
    a local role or with a local user account; if the user has role B
    from the start, it works. This one particularly gave me a lot of 
    grief.

The workaround that gets closest to what I want is to define the external
methods in folder higher up instead. But that's not really desirable, in
my circumstances I want the external method callable in the entire site,
if the user is authenticated.

Some minor observations:

  * ZClass instances seem to be affected as well. I'm not as sure about
    the symptoms here though.

Anyway, I tried to upgrade to 2.2.2 to avoid this bug in particular, but
the only thing I got was a NameError instead of an Authentication
error. Sigh..

It doesn't appear to be a security leak, it appears to be overzealeous
security instead. :)

I'll also dump this description into the collector, but posted to the
list because I like to complain. And who knows, perhaps someone else
ran into the same.

Regards,

Martijn