mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 14:00:37 +00:00
606d68e2b4
GHSA-m53j-2766-6jqw. A websocket subscription checks read permission once, at subscribe time, then relays every message published to the topic for the rest of the connection's life. A member whose access is revoked keeps receiving live file content as long as the tab stays open, because nothing re-checks the permission. These tests reproduce the leak against the real message bus, so the failure is observed end to end rather than assumed: - revoked-member-stops-receiving-file-changes: after delete-team-member the socket still receives the :file-change diff. - revoked-member-stops-receiving-library-changes: leave-team keeps the team subscription alive, leaking :library-change diffs. - role-downgrade-keeps-revocation-irrelevant: a downgrade to :viewer keeps read access, so the subscription must survive it. Guards against a fix that closes subscriptions too eagerly. The two revocation tests fail on the current code; the role test passes and pins the behavior a fix must not break. Closes #12155 AI-assisted-by: space-bunny-free