Skip to content

Fix NPE with ApiKeyPair during listApis call (from cmk) #13149

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sureshanaparti wants to merge 1 commit into
base: main
Choose a base branch
from
+13 −6
Open

Fix NPE with ApiKeyPair during listApis call (from cmk) #13149

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 13 additions & 6 deletions server/src/main/java/com/cloud/user/AccountManagerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3202,7 +3202,7 @@ public Pair<Boolean, Map<String, String>> getKeys(GetUserKeysCmd cmd) {
ApiKeyPair keyPair;
if (accessingApiKey != null) {
ApiKeyPair accessingKeyPair = apiKeyPairService.findByApiKey(accessingApiKey);
if (userId == accessingKeyPair.getUserId()) {
if (accessingKeyPair != null && userId == accessingKeyPair.getUserId()) {
keyPair = apiKeyPairService.findByApiKey(accessingApiKey);
} else {
keyPair = _accountService.getLatestUserKeyPair(userId);
Expand Down Expand Up @@ -3320,6 +3320,10 @@ private Boolean isAccessingKeypairSuperset(ApiKeyPair accessedKeyPair, BaseCmd c
return Boolean.TRUE;
}
ApiKeyPair accessingKeyPair = apiKeyPairService.findByApiKey(apiKey);
if (accessingKeyPair == null) {
logger.warn("Unable to find API key pair for the accessing API key: {}", apiKey);
return Boolean.TRUE;
Copy link
Copy Markdown
Member

@weizhouapache weizhouapache May 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did not check the whole workflow, I am not sure if it is fine to return true here
it would be better others can review and evaluate the side-effects

Copy link
Copy Markdown
Member

@winterhazel winterhazel May 28, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that it is better to return false here instead. Could you have a look @bernardodemarco?

This method validates whether the keypair being used is a superset of the keypair being accessed in order to prevent a key with less privileges to get keys with more privileges. true is returned when an apiKey is not being used to call the API, which makes sense as this check is not necessary in this case. However, as a keypair is being used here, I think that it would make more sense to either inform that it is not a superset, as we could not obtain the key to confirm, or throw a runtime exception.

Copy link
Copy Markdown
Member

@bernardodemarco bernardodemarco May 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@weizhouapache @winterhazel great catch guys... you are correct, we should return Boolean.FALSE here.

When I first reviewed the PR, I had not paid too much attention and I had inferred that we would have to return Boolean.TRUE because of the first conditional statement. But, as Fabricio has explained here https://github.com/apache/cloudstack/pull/13149/changes#r3320265882, the first conditional structure checks whether the API call is performed via session key.

}
return isApiKeySupersetOfPermission(new ArrayList<>(getAllKeypairPermissions(accessingKeyPair.getApiKey())), new ArrayList<>(getAllKeypairPermissions(accessedKeyPair.getApiKey())));
}

Expand All @@ -3335,7 +3339,7 @@ public String getAccessingApiKey(BaseCmd cmd) {
return accessingApiKey;
}
} catch (NullPointerException e) {
logger.info("Accessing API through session.");
logger.info("Accessing API through session.", e);
}
return null;
}
Expand Down Expand Up @@ -3582,6 +3586,10 @@ public List<RolePermissionEntity> getAllKeypairPermissions(String apiKey) {
throw new InvalidParameterValueException("API key not present in the request's URL and, thus, unable to fetch API key rules.");
}
ApiKeyPair apiKeyPair = keyPairManager.findByApiKey(apiKey);
if (apiKeyPair == null) {
logger.warn("Unable to find API key pair by API key: {}", apiKey);
return new ArrayList<>();
}
Account account = _accountDao.findById(apiKeyPair.getAccountId());
List<ApiKeyPairPermission> keyPairPermissions = keyPairManager.findAllPermissionsByKeyPairId(apiKeyPair.getId(), account.getRoleId());
return new ArrayList<>(keyPairPermissions);
Expand Down Expand Up @@ -3848,12 +3856,11 @@ public void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledViewEn
@Override
public UserAccount getUserByApiKey(String apiKey) {
ApiKeyPairVO keyPair = apiKeyPairDao.findByApiKey(apiKey);

if (keyPair == null) {
return null;
if (keyPair != null) {
return userAccountDao.findById(keyPair.getUserId());
}

return userAccountDao.findById(keyPair.getUserId());
return null;
}

@Override
Expand Down
Loading