MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary

When MLflow is deployed with the built-in basic-auth plugin (--app-name basic-auth), any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFORE_REQUEST_HANDLERS map in mlflow/server/auth/__init__.py, so the before-request hook skips authorization entirely and the request succeeds. Standard write endpoints on the same run -- such as POST /api/2.0/mlflow/runs/log-metric -- correctly return HTTP 403.

Details

MLflow's basic-auth app gates every HTTP handler through a before-request hook (_before_request) that looks up the relevant permission validator in BEFORE_REQUEST_VALIDATORS. Validators are built from the BEFORE_REQUEST_HANDLERS dictionary, which maps each protobuf request class to a callable. When a class is absent from the dict (or mapped to None), get_before_request_handler returns None, and the resulting entry in BEFORE_REQUEST_VALIDATORS is (path, method): None.

Inside _before_request:

# mlflow/server/auth/__init__.py  _before_request()
if validator := _find_validator(request):   # None is falsy -- branch skipped
    if not validator():
        return make_forbidden_response()
elif _is_proxy_artifact_path(request.path):  # not a proxy path
    ...
# falls through: any authenticated request is allowed