21214: Prevent filter groups from matching other/same filter groups.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>

diff --git a/lib/controller/localdb/group.go b/lib/controller/localdb/group.go
index 418fd6b8b7ec5bcc955c62c0d1207b66284d587b..a21a062db805d77563de347e19208215848beddf 100644 (file)
--- a/lib/controller/localdb/group.go
+++ b/lib/controller/localdb/group.go
@@ -97,6 +97,12 @@ func (conn *Conn) GroupContents(ctx context.Context, options arvados.GroupConten
                                filter.Operand = tmp[2]
                                options.Filters = append(options.Filters, filter)
                        }
+                       // Prevent infinite-depth trees caused by a
+                       // filter group whose filters match [other
+                       // filter groups that match] itself. Such
+                       // cycles are supported by sitefs, but they
+                       // cause havoc in webdav. See #21214.
+                       options.Filters = append(options.Filters, arvados.Filter{"groups.group_class", "=", "project"})
                } else {
                        return resp, fmt.Errorf("filter unparsable: not an array\n")
                }