{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/2571","repository_url":"https://api.github.com/repos/spring-projects/spring-security","labels_url":"https://api.github.com/repos/spring-projects/spring-security/issues/2571/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security/issues/2571/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security/issues/2571/events","html_url":"https://github.com/spring-projects/spring-security/issues/2571","id":131776682,"number":2571,"title":"SEC-2342: DefaultPermissionGrantingStrategy directly compares permission mask","user":{"login":"spring-issuemaster","id":16028288,"avatar_url":"https://avatars.githubusercontent.com/u/16028288?v=3","gravatar_id":"","url":"https://api.github.com/users/spring-issuemaster","html_url":"https://github.com/spring-issuemaster","followers_url":"https://api.github.com/users/spring-issuemaster/followers","following_url":"https://api.github.com/users/spring-issuemaster/following{/other_user}","gists_url":"https://api.github.com/users/spring-issuemaster/gists{/gist_id}","starred_url":"https://api.github.com/users/spring-issuemaster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spring-issuemaster/subscriptions","organizations_url":"https://api.github.com/users/spring-issuemaster/orgs","repos_url":"https://api.github.com/users/spring-issuemaster/repos","events_url":"https://api.github.com/users/spring-issuemaster/events{/privacy}","received_events_url":"https://api.github.com/users/spring-issuemaster/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/ACLs","name":"ACLs","color":"000000"},{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Bug","name":"Bug","color":"eeeeee"},{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Jira","name":"Jira","color":"ededed"},{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Open","name":"Open","color":"ededed"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2013-09-25T05:28:34Z","updated_at":"2016-09-28T13:00:58Z","closed_at":null,"body":"[Igor Artamonov](https://jira.spring.io/secure/ViewProfile.jspa?name=iartamonov) (Migrated from [SEC-2342](https://jira.spring.io/browse/SEC-2342?redirect=false)) said:\n\n`DefaultPermissionGrantingStrategy.isGranted` uses direct comparison for the permission `mask`:\n``` \n//line :68\nif ((ace.getPermission().getMask() == p.getMask()) && ace.getSid().equals(sid)) {\n``` \n\nSo, for:\n\n * composite mask \"*RW*\" (`ace` mask is 3) \n * when we require \"*R*\" (`p` mask is 1) permission \n\n`isGranted` will return `false`.\n\nI believe there should be `&` used, instead of `==` "},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/comments/250159565","html_url":"https://github.com/spring-projects/spring-security/issues/2571#issuecomment-250159565","issue_url":"https://api.github.com/repos/spring-projects/spring-security/issues/2571","id":250159565,"user":{"login":"kortatu","id":266776,"avatar_url":"https://avatars.githubusercontent.com/u/266776?v=3","gravatar_id":"","url":"https://api.github.com/users/kortatu","html_url":"https://github.com/kortatu","followers_url":"https://api.github.com/users/kortatu/followers","following_url":"https://api.github.com/users/kortatu/following{/other_user}","gists_url":"https://api.github.com/users/kortatu/gists{/gist_id}","starred_url":"https://api.github.com/users/kortatu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kortatu/subscriptions","organizations_url":"https://api.github.com/users/kortatu/orgs","repos_url":"https://api.github.com/users/kortatu/repos","events_url":"https://api.github.com/users/kortatu/events{/privacy}","received_events_url":"https://api.github.com/users/kortatu/received_events","type":"User","site_admin":false},"created_at":"2016-09-28T13:00:58Z","updated_at":"2016-09-28T13:00:58Z","body":"I've done the same as @ndouba , copy the code in my PermissionGrantingStrategy but executing a bitwise and operation and comparing with 0."}}
{"actor":{"display_login":"kortatu"}}