Sjoerd Langkemper

[Rewrite IDOR cheat sheet by Sjord · Pull Request #1177 · OWASP/CheatSheetSeries](https://github.com/OWASP/CheatSheetSeries/pull/1177)

We could reconsider whether parser.c should be committed at all. It is auto-generated with tree-sitter generate, so I am not sure it should be in the repository.

Indeed the used identifier is incorrect. It would perform a call to /api/v4/projects/1/merge_requests/1/approval_rules/3 instead of /api/v4/projects/1/merge_requests/1/approval_rules/1 when saving. The unit test [here](https://github.com/python-gitlab/python-gitlab/blob/72e1aa7f2c2aad739db2f5dd4394165a5b5f2432/tests/unit/objects/test_project_merge_request_approvals.py#L13) does not catch that, since the project ID,...

`gitlab group-ldap-group-link list --group-id xxxxxx` performs a request to `/api/v4/groups/xxxxxx/ldap_group_links`, and the response looks like this: ``` [{"cn":"foo","group_access":10,"provider":"ldap"}] ```

Setting `_id_attr = None` would at least get rid of the exception, and then `--verbose` can be used to also display the `cn` or `filter` fields. Since `_id_attr` is a...

[ProjectIntegration](https://github.com/python-gitlab/python-gitlab/blob/72e1aa7f2c2aad739db2f5dd4394165a5b5f2432/gitlab/v4/objects/integrations.py#L27-L28): ``` class ProjectIntegration(SaveMixin, ObjectDeleteMixin, RESTObject): _id_attr = "slug" ``` In [cli.py](https://github.com/python-gitlab/python-gitlab/blob/72e1aa7f2c2aad739db2f5dd4394165a5b5f2432/gitlab/v4/cli.py#L301-L305): ``` # We need to get the object somehow if not issubclass(cls, gitlab.mixins.GetWithoutIdMixin): if cls._id_attr is not None:...

I at least changed the unit test to have different ids for different entities, so that a mixup in ids would become noticable.

I consider this ready to be merged. @JohnVillalovos suggested adding functional tests, but I updated the unit tests instead to test this functionality. Is that sufficient? @david-vana-conrad, perhaps you can...

This currently assumes a job token scope as the parent of the allowlist, but I don't think that is correct. I would expect the allowlist to work without retrieving the...

> Padding Oracle I agree that this should be lower case, and also the following should be lower case: - libraries do not contain Easter eggs - This should prevent...