Require job access in coverage_report before redirecting

src/appengine/handlers/coverage_report.py

@@ -20,6 +20,7 @@
 from clusterfuzz._internal.datastore import data_types
 from clusterfuzz._internal.metrics import fuzzer_stats
 from handlers import base_handler
+from libs import access
 from libs import handler
 from libs import helpers
 
@@ -60,6 +61,13 @@ def get_report_url(report_type, argument, date):
   if not data_types.Job.VALID_NAME_REGEX.match(job):
     raise helpers.EarlyExitError('Invalid job name.', 400)
 
+  # Coverage reports are per-job data; gate on job access like the other
+  # job-scoped handlers (e.g. fuzzer_stats). @handler.oauth does not require
+  # authentication, so without this any caller could resolve the report URL
+  # for an arbitrary job.
+  if not access.has_access(job_type=job):
+    raise helpers.AccessDeniedError()
+
   if not date or not VALID_DATE_REGEX.match(date):
     raise helpers.EarlyExitError('Invalid date.', 400)
 

src/clusterfuzz/_internal/tests/appengine/handlers/coverage_report_test.py

@@ -19,6 +19,7 @@
 from clusterfuzz._internal.tests.test_libs import helpers
 from clusterfuzz._internal.tests.test_libs import test_utils
 from handlers import coverage_report
+from libs import helpers as libs_helpers
 
 
 @test_utils.with_cloud_emulators('datastore')
@@ -27,6 +28,10 @@ class CoverageReportTest(unittest.TestCase):
 
   def setUp(self):
     helpers.patch_environ(self)
+    helpers.patch(self, ['libs.access.has_access'])
+    # Default to a caller that is allowed to access the job; the access-denied
+    # path is exercised explicitly in test_no_access.
+    self.mock.has_access.return_value = True
 
     self.today = datetime.datetime.utcnow().date()
     self.today_minus_2 = self.today - datetime.timedelta(days=2)
@@ -63,3 +68,11 @@ def test_get_none(self):
     report_url = coverage_report.get_report_url('job', 'fake_job', 'latest')
     expected_url = None
     self.assertEqual(expected_url, report_url)
+
+  def test_no_access(self):
+    """Tests that a caller without access to the job is denied instead of
+    being handed the coverage report location."""
+    self.mock.has_access.return_value = False
+    with self.assertRaises(libs_helpers.AccessDeniedError):
+      coverage_report.get_report_url('job', 'job1', 'latest')
+    self.mock.has_access.assert_called_with(job_type='job1')