NightOwl888
commented
11 years ago I started to refactor the AuthorizeAttributeAclModule primarily because it is just way to complicated to understand and fix bugs/add new features in there, and there is an open issue #130 about a new Attribute for MVC 4 that the module is ignoring that I would like to address. I started by breaking it into smaller methods without changing the logic.
I went back to the very beginning of the history on codeplex and it seems it hasn't been touched much since then, so I am hoping you might be able to shed some light on some of the logic that is in there.
Specifically, there is an inconsistency that seems really odd. Consider the following blocks:
64 // Time to delve into the AuthorizeAttribute defined on the node.
65 // Let's start by getting all metadata for the controller...
66 var controllerType = controllerTypeResolver.ResolveControllerType(mvcNode.Area, mvcNode.Controller);
67 if (controllerType == null)
68 {
69 return false;
70 }
/// Code omitted for clarity
111 ControllerDescriptor controllerDescriptor = null;
112 if (typeof(IController).IsAssignableFrom(controllerType))
113 {
114 controllerDescriptor = new ReflectedControllerDescriptor(controllerType);
115 }
116 else if (typeof(IAsyncController).IsAssignableFrom(controllerType))
117 {
118 controllerDescriptor = new ReflectedAsyncControllerDescriptor(controllerType);
119 }
Basically, we're saying by exiting out of the first block "If we can't get a controller descriptor (because we can't get it without the type), return not authorized."
The only other place the type is used is for a fallback effort to create a controller using Reflection when the ControllerFactory fails.
However, consider this bit:
121 ActionDescriptor actionDescriptor = null;
122 try
123 {
124 actionDescriptor = controllerDescriptor.FindAction(controllerContext, mvcNode.Action);
125 }
126 catch
127 {
128 }
129 if (actionDescriptor == null)
130 {
131 actionDescriptor = controllerDescriptor.GetCanonicalActions().Where(a => a.ActionName == mvcNode.Action).FirstOrDefault();
132 }
133
134 // Verify security
135 try
136 {
137 if (actionDescriptor != null)
138 {
// Block omitted for clarity
180 }
181
182 // No objection.
183 return true;
184 }
185 finally
186 {
187 // Restore HttpContext
188 httpContext.RewritePath(originalPath, true);
189 }
Basically what we are saying here is "If we can't get an action descriptor (in which case it would be null), return authorized".
So why the different result? It seems like if either of them can't be retrieved we can't reach a conclusion whether authorized or not, so we should probably return the same decision. But which should be the default?
Note also this comment:
/// From DefaultAclModule
try
{
result &= module.IsAccessibleToUser(controllerTypeResolver, provider, context, node);
}
catch (AclModuleNotSupportedException)
{
result &= true; // Convention throughout the provider: if the IAclModule can not authenticate a user, true is returned.
}
According to this, the default should always be true...? Also seems odd.
maartenba
waynebrantley
As it's been a while since ASP.NET MVC 4 is out and seeing that ASP.NET Web API dropped dependencies on System.Web, I'm kind of looking at evolving MvcSitemapProvider in that direction too...
vNext would:
That's the technical side. What about features? I would love to hear what you are using today, what you would not want to miss, what's currently missing, anything!