{"record":{"id":"4ec2dc9e4102e5a1","repo":"paascloud/paascloud-master","slug":"uac10011023-4ec2dc","errorCode":"UAC10011023","errorMessage":"越权操作","messagePattern":"越权操作","errorType":"error_code","errorClass":"UacBizException","httpStatus":null,"severity":"error","filePath":"paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacRoleServiceImpl.java","lineNumber":129,"sourceCode":"\t\tfor (MenuCountVo vo : menuCountVos) {\n\t\t\tnoCheckedMenu.add(vo.getId());\n\t\t}\n\n\t\treturn noCheckedMenu;\n\t}\n\n\t@Override\n\tpublic void bindAction(RoleBindActionDto grantAuthRole) {\n\t\tLong roleId = grantAuthRole.getRoleId();\n\t\tSet<Long> actionIdList = grantAuthRole.getActionIdList();\n\n\t\tif (roleId == null) {\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10012001);\n\t\t}\n\n\t\tif (Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {\n\t\t\tlogger.error(\"越权操作, 超级管理员用户不允许操作\");\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10011023);\n\t\t}\n\n\t\tUacRole uacRole = uacRoleMapper.selectByPrimaryKey(roleId);\n\n\t\tif (uacRole == null) {\n\t\t\tlogger.error(\"找不到角色信息. roleId={}\", roleId);\n\t\t\tthrow new UacBizException(ErrorCodeEnum.UAC10012005, roleId);\n\t\t}\n\n\t\t// TODO 校验参数的合法性(这里不写了 累得慌 也就是校验菜单和权限是否存在)\n\t\tList<UacRoleAction> uacRoleActionList = uacRoleActionService.listByRoleId(roleId);\n\n\t\tif (PublicUtil.isNotEmpty(uacRoleActionList)) {\n\t\t\tuacRoleActionService.deleteByRoleId(roleId);\n\t\t}\n\n\t\tif (PublicUtil.isEmpty(actionIdList)) {\n\t\t\tlogger.error(\"传入按钮权限Id为空, 取消所有按钮权限\");","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacRoleServiceImpl.java#L111-L147","documentation":"UacBizException UAC10011023 ('越权操作' / unauthorized operation) thrown by UacRoleServiceImpl.bindAction when the target roleId equals GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID. Modifying the permissions of the built-in super-admin role is forbidden to prevent privilege escalation beyond the fixed super role.","triggerScenarios":"Calling bindAction with the super-manager role ID as target — an attempt to add/remove permissions on the system super role.","commonSituations":"Admin UI not hiding the super role from the permission-assignment screen; scripted role-management hitting the protected ID; an attacker probing the endpoint.","solutions":["Exclude the super role from assignable role lists in the UI/API responses","Check roleId against SUPER_MANAGER_ROLE_ID in the client before submitting","Treat this as a security signal — log and review the caller if unexpected"],"exampleFix":"// before\nuacRoleService.bindAction(new RoleBindActionDto(GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID, actionIds));\n// after\nif (Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {\n    throw new IllegalArgumentException(\"super manager role is immutable\");\n}\nuacRoleService.bindAction(new RoleBindActionDto(roleId, actionIds));","handlingStrategy":"validation","validationCode":"if (Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {\n    return Result.error(\"超级管理员角色不允许修改权限\");\n}","typeGuard":"boolean isSuperManagerRole(Long roleId) { return Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID); }","tryCatchPattern":"try {\n    uacRoleService.bindAction(dto);\n} catch (UacBizException e) {\n    if (ErrorCodeEnum.UAC10011023.getCode().equals(e.getCode())) {\n        logger.warn(\"attempt to modify super manager role, roleId={}\", dto.getRoleId());\n        return Result.error(\"越权操作\");\n    }\n    throw e;\n}","preventionTips":["Never include the super role in editable role lists from APIs","Check the protected ID client-side before submitting","Treat repeated occurrences as a potential security probe and alert"],"tags":["java","permission","security","uac","privilege-escalation"],"backgroundTag":"permission-denied","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}