Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deleting and renaming a GitHub team gives it a new GitHub ID, which causes uniqueness constraint violations #6949

Open
carols10cents opened this issue Aug 9, 2023 · 1 comment
Labels
A-backend ⚙️ C-bug 🐞 Category: unintended, undesired behavior

Comments

@carols10cents
Copy link
Member

Related but slightly distinct:

To reproduce:

  • Create a github team in an org and run cargo owners --add github:org:team to add the team as an owner of the crate.
  • Delete the team in github and recreate it with the same name. This should give the team a new github ID.
  • Attempt to add the team to a different crate, issuing the same cargo owners --add github:org:team command.
  • Crates.io will return a uniqueness constraint violation because we enforce unique team names.

If we get the same ID but a different name, we upsert and update the name. But we aren't doing that for teams. I think as long as the org's github id is the same (that is, the entire organization hasn't been deleted and recreated), it isn't a security problem if we update the team ID when the names are the same (as it indicates the same organization has deleted and recreated the team).

@nic-hartley
Copy link
Contributor

nic-hartley commented Sep 14, 2023

Ah. Hm. I think I noticed this while working on #7051 and then I dismissed it because, surely, if it was an issue, it'd have already been noticed, so it can't be that big a deal. Whoops.

The consensus there was that the status quo is not a security issue because we're reusing the org ID rather than the name, yep. But it's still a usability issue of not being able to reuse org names.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
A-backend ⚙️ C-bug 🐞 Category: unintended, undesired behavior
Projects
None yet
Development

No branches or pull requests

3 participants