[akgarg06]

Jira task : https://jira.tools.sap/browse/RBSDMS-1202

Issue

The changelog action had two security gaps:

1. Missing parent-scope enforcement (DB layer)
DBQuery.getObjectIdForAttachmentID accepted only the attachment ID as a filter. The handler retrieved attachment data without verifying that the attachment belonged to the parent record in the request, enabling cross-record data access (IDOR). When the attachment had no objectId (e.g. a stub record), row.get("objectId").toString() threw a NullPointerException, returning a 500 instead of a meaningful error.

2. Missing ACL pre-check (SDM layer)
SDM's getChangeLog API does not enforce user-level access control — it returns changelog data regardless of whether the requesting user has permission to view the document. Without a pre-check, any authenticated user could fetch the changelog of any attachment they could name.

---

Fix

DB layer — parent-scoped attachment lookup

• SDMServiceGenericHandler.java

  • Derives upIdKey (e.g. up__ID) from the draft attachment entity via SDMUtils.getUpIdKey.
  • Derives upId (parent record key value) from the request CQN via SDMUtils.fetchUPIDFromCQN.
  • Throws FILE_NOT_FOUND_ERROR if parent scope cannot be determined or the attachment is not found within the authorized parent.
  • Adds private helper lookupAttachmentScoped consolidating draft/active entity fallback with parent-scoped DB calls.

• DBQuery.java

  • New getObjectIdForAttachmentID overload accepting upIdKey and upId, scoping the query with .where(doc.get("ID").eq(id).and(doc.get(upIdKey).eq(upId))).

SDM layer — ACL pre-check via getObject

• SDMServiceGenericHandler.java

  • Calls sdmService.getObject(objectId) before sdmService.getChangeLog(objectId).
  • If getObject returns null → throws FILE_NOT_FOUND_ERROR.
  • If getObject throws an access-denied exception (HTTP 403 from SDM, translated by SDMServiceImpl to USER_NOT_AUTHORISED_ERROR) → rethrows as CHANGELOG_NOT_AUTHORISED_ERROR and aborts before calling getChangeLog. Condition uses equals(SDMUtils.getErrorMessage("USER_NOT_AUTHORISED_ERROR")) to match the already-translated message, not the raw SDM response body.

• SDMErrorMessages.java

  • New constant CHANGELOG_NOT_AUTHORISED_ERROR = "You do not have the required permissions to view the changelog. Please contact your administrator for access." — separate from the existing USER_NOT_AUTHORISED_ERROR used for upload permission errors, ensuring no impact on existing upload flows.

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)

Checklist before requesting a review

• I follow Java Development Guidelines for SAP
• I have tested the functionality on my cloud environment.
• I have provided sufficient automated/ unit tests for the code.
• I have increased or maintained the test coverage.
• I have ran integration tests on my cloud environment.
• I have validated blackduck portal for any vulnerability after my commit.

Upload Screenshots/lists of the scenarios tested

• I have Uploaded Screenshots or added lists of the scenarios tested in description