gristlabs_grist-core/app/server
Alex Hall 887717bb15 (core) Decode cell values to prevent working around rule using 'in' on lists
Summary:
Fixes bug described in https://grist.slack.com/archives/C069RUP71/p1699643458649019

Decodes cell values obtained from `InfoView.get` when evaluating user-defined ACL formulas, i.e. the result of `rec.foo` in such a formula. In particular this is so that `rec.some_list` loses the leading `L` type code and behaves sensibly in an expression like `thing in rec.some_list`.

`InfoView.get` is called in many places, but for every usage I found other than here, leaving the cell values encoded was best.

Test Plan: Added two unit server tests. The first is for the main bug involving lists. The second checks the only other plausible way I could think of that this change affects behaviour, and it seems to be for the better since both tests failed before. Most operations involving non-primitive cell values don't do anything sensible with or without decoding, so behaviour shouldn't change meaningfully in those cases.

Reviewers: georgegevoian, paulfitz

Reviewed By: georgegevoian, paulfitz

Subscribers: paulfitz

Differential Revision: https://phab.getgrist.com/D4123
2023-12-04 23:34:08 +02:00
..
declarations (core) disentangle some server tests, release to core, add GRIST_PROXY_AUTH_HEADER test 2022-03-24 15:11:32 -04:00
lib (core) Decode cell values to prevent working around rule using 'in' on lists 2023-12-04 23:34:08 +02:00
utils (core) sanitizing redis errors 2023-06-06 10:51:17 +02:00
companion.ts (core) Add Support Grist page and nudge 2023-07-04 17:36:59 -04:00
declarations.d.ts (core) Faster builds all around. 2022-07-04 10:42:40 -04:00
devServerMain.ts (core) support for bundling custom widgets with the Grist app 2023-10-27 17:00:10 -04:00
generateCheckpoint.ts (core) get all tests working under python3/gvisor 2021-10-18 17:44:15 -04:00
generateInitialDocSql.ts (core) Add optional telemetry to grist-core 2023-06-07 12:00:51 -04:00
localization.ts only offer languages that have been marked as substantially complete (#466) 2023-03-28 10:59:17 -04:00
mergedServerMain.ts (core) change handling of server access prior to full configuration 2023-10-31 17:42:48 -04:00
tsconfig.json (core) Simple localization support and currency selector. 2021-08-26 13:36:49 -07:00