Security and DVCS Connection/SmartCommits features

Antoine Millet2

Hello,

When I configure DVCS connection on my Jira instance and my Bitbucket account, Jira will configure a link for each repository hosted by the Bitbucket account. The link configured look like this:

From: Custom ((?<!\w)(()-\d+)(?!\w))
To: https://example.atlassian.net/browse/\1

Each time I push a commit with a new issue key, the link is automatically edited with the new project key. For example:

From: Custom ((?<!\w)((TEST|DEMO)-\d+)(?!\w))
To: https://example.atlassian.net/browse/\1

I can see a security problem with this, and the SmartCommits feature: if user-1 has a write access to a project-1, and a user-2 has only the read access on project-1, but has a write access on the repository-1 on bitbucket, forge a commit with user-1 as author, he can act on the project-1 issues behind the user-1 account.

Is there a way to force DVCS connection to only link a given Bitbucket repository to a given Jira project?

Thanks,
Antoine.

aMarcus

Hi Antoine,

This is not how the integration functions. The issue links on your Bitbucket repository are only to 'dress up' the issue keys when presented on the Bitbucket website. The DVCS connector in JIRA connects commits to issues by reading the issue key on the actual commit message. The smart commit transitions will trigger if the email address associated with the commit match the user's email address in JIRA.

To be fair, there is always the possibility that your end-users could set a different username/email address to be stored on their commits. This is part of the intentional design of Git and Mercurial and outside of the control of Bitbucket or JIRA.

Cheers,

Marcus Bertrand - Bitbucket Support