fix: reject cross-org copy/move destinations instead of misdelivering#301
Merged
Conversation
The copy and move helpers parsed the destination form field with
split('/').slice(1), silently discarding the destination's org segment
and re-anchoring the path under the request org. A cross-org copy
returned 204 and created a phantom copy inside the source org; nothing
reached the intended destination org (confirmed against production
admin.da.live on 2026-07-10). Under a restrictive source-org ACL the
same request surfaced as a misleading 403.
Compare the destination's org segment to the request org and return an
explicit 400 on mismatch. Both endpoints are documented as operating
within an organization, and 400 is already a documented response code
for both. The underlying feature ask is adobe/da-live#623.
Relates to adobe/da-live#34.
kptdobe
reviewed
Jul 14, 2026
kptdobe
approved these changes
Jul 14, 2026
Contributor
|
Thanks @benpeter. I'll merge as soon as you addresses my very little comment. |
adobe-bot
pushed a commit
that referenced
this pull request
Jul 14, 2026
## [1.12.3](v1.12.2...v1.12.3) (2026-07-14) ### Bug Fixes * reject cross-org copy/move destinations instead of misdelivering ([#301](#301)) ([fd7a351](fd7a351))
Collaborator
|
🎉 This PR is included in version 1.12.3 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The copy and move helpers dropped the
destinationfield's first path segment unconditionally. A destination in a different org (e.g. cross-org paste, adobe/da-live#623) had its org silently discarded and the path re-anchored under the request org: the request returned 204 and created a phantom copy inside the source org — nothing reached the intended org, and the caller got no error.Since storage pins all keys to the request org, a cross-org destination can never be honored. Both helpers now compare the destination's org segment to the request org and return
400 {"error":"Destination must be in the same org as the source."}on mismatch.Tests: route-level rejection and mixed-case same-org acceptance; integration coverage for same-org copy, cross-org copy (400, no phantom), and cross-org move (400, source intact).
Relates to adobe/da-live#623, adobe/da-live#34.