Merge pull request #407 from creative-commoners/pulls/3.5/CVE-2021-28661

[CVE-2021-28661] Add a CanViewPermissionChecker if permission checker is null

src/Permission/PermissionCheckerAware.php

@@ -3,6 +3,8 @@
 
 namespace SilverStripe\GraphQL\Permission;
 
+use SilverStripe\Core\Injector\Injector;
+
 trait PermissionCheckerAware
 {
     /**
@@ -26,6 +28,10 @@ public function setPermissionChecker(QueryPermissionChecker $checker)
      */
     public function getPermissionChecker()
     {
-        return $this->permissionChecker;
+        $checker = $this->permissionChecker;
+        if (is_null($checker)) {
+            return Injector::inst()->get(QueryPermissionChecker::class . '.default');
+        }
+        return $checker;
     }
 }

tests/Permission/PermissionCheckerAwareTest.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace SilverStripe\GraphQL\Tests\Permission;
+
+use SilverStripe\Dev\SapphireTest;
+use SilverStripe\GraphQL\Permission\PermissionCheckerAware;
+use SilverStripe\GraphQL\Permission\QueryPermissionChecker;
+use SilverStripe\Security\Member;
+use SilverStripe\ORM\Filterable;
+use SilverStripe\Core\Injector\Injector;
+
+class PermissionCheckerAwareTest extends SapphireTest
+{
+    public function testCanViewPermissionCheckerAddedIfNull()
+    {
+        $scaffolder = new class() {
+            use PermissionCheckerAware;
+        };
+        $checker = $scaffolder->getPermissionChecker();
+        $defaultChecker = Injector::inst()->get(QueryPermissionChecker::class . '.default');
+        $this->assertNotNull($checker);
+        $this->assertSame(get_class($defaultChecker), get_class($checker));
+    }
+
+    public function testDefaultCanViewPermissionCheckerNotAddedIfSet()
+    {
+        $scaffolder = new class() {
+            use PermissionCheckerAware;
+        };
+        $nonChecker = new class () implements QueryPermissionChecker {
+            public function applyToList(Filterable $list, Member $member = null)
+            {
+                return $list;
+            }
+
+            public function checkItem($item, Member $member = null)
+            {
+                return true;
+            }
+
+            public function testMe()
+            {
+                return true;
+            }
+        };
+        $scaffolder->setPermissionChecker($nonChecker);
+        $checker = $scaffolder->getPermissionChecker();
+        $this->assertNotNull($checker);
+        $this->assertTrue(method_exists($checker, 'testMe'));
+    }
+}