Global labels are publicly accessible without authentication

[SimonAlling]

$ curl "https://example.com/api/v2.0/labels?scope=g"
[{"color":"#F52F52","creation_time":"2021-07-05T16:21:06.911Z","description":"Testing","id":2,"name":"test","scope":"g","update_time":"2021-07-05T16:21:06.911Z"},…]

In particular, the label description may contain sensitive information, and Harbor admins cannot be expected to realize that everything they put in label descriptions is accessible to everyone on the Internet. (Note that "global" in this context means "not project-scoped".)

We have reported this according to the security vulnerability guidelines and received a reply that this is by design. We're creating this issue because we're not convinced that the design is good.

[SimonAlling]

Possibly related: #12306

[wy65701436]

It's by designed since every one can attach the system level(global) label to any specific artifact.

[SimonAlling]

every one can attach the system level(global) label to any specific artifact.

Could you please clarify what this means?

[lindhe]

@wy65701436 If I understand you correctly, I must disagree with what you are saying. Not everyone should be able to attach system level labels to artifacts. Surely only authorized users should be able to do that.

You say this is by design. What exactly is the intended use-case that you are designing for here? Why should any unauthorized user be able to access details about my artifacts?

[github-actions]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

[lindhe]

Please keep this open.

[github-actions]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

[github-actions]

This issue was closed because it has been stalled for 30 days with no activity. If this issue is still relevant, please re-open a new issue.

[lindhe]

@wy65701436 Hi! Have you had time to read my comment?