Skip to content

BSL246 — The check box «Set permissions for new objects» should only be selected for the FullAccess role

← All rules

Summary

The check box «Set permissions for new objects» should only be selected for the FullAccess role

Identifiers

Field Value
Rule code BSL246
Compatible alias SetPermissionsForNewObjects
Severity ERROR
Enabled by default Yes
Implemented Yes
Tags security, access-control

Behavior

  • The public identifier BSL246 and alias SetPermissionsForNewObjects are stable.
  • The rule reports the cases documented on this page.
  • Suppressions and project configuration are applied before publication.
  • The rule requires neither an external analyzer nor network access.

Configuration and suppression

BSL### is the primary stable identifier. The compatible alias is accepted in select, ignore, and compatible block suppression comments.

[tool.onec-hbk-bsl]
select = ["BSL246"]
ignore = ["SetPermissionsForNewObjects"]

All three suppression families support both a current line and a range. When an opening comment follows code, it affects only that line. Use any one form:

  • noqa:
Value = "example";  // noqa: BSL246
  • bsl-disable:
Value = "example";  // bsl-disable: BSL246
  • compatible BSLLS form:
Value = "example";  // BSLLS:SetPermissionsForNewObjects-off

When the same opening comment is on a line by itself, it starts a range. Close it with the matching marker from the same family:

// noqa: BSL246
// code without this diagnostic
// noqa-enable: BSL246

// bsl-disable: BSL246
// code without this diagnostic
// bsl-enable: BSL246

// BSLLS:SetPermissionsForNewObjects-off
// code without this diagnostic
// BSLLS:SetPermissionsForNewObjects-on

To disable the rule until the end of the file, omit the closing noqa-enable, bsl-enable, or BSLLS:…-on marker.

Opening and closing markers must belong to the same family.

Description

When adding a new role, the "Set permissions for new objects" attribute may be set incorrectly, which will lead to the accumulation of rights in this role for all objects added after it and extra rights for users with this role.

Examples

Sources