Language: Go
Label: safe
CWE: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Code:
func (ns *nodeServer) prepareSessMgr(workDir string) error {
	sessMgrLabelKey := common.SessMgrNodeSelectorKey
	var labelsToModify common.LabelsToModify
	labelsToModify.Add(sessMgrLabelKey, "true")

	node, err := ns.getNode()
	if err != nil {
		return errors.Wrapf(err, "can't get node %s", ns.nodeId)
	}

	// _, err = utils.ChangeNodeLabelWithPatchMode(ns.client, node, labelsToModify)
	err = ns.patchNodeWithLabel(node, labelsToModify)
	if err != nil {
		return errors.Wrapf(err, "error when patching labels on node %s", ns.nodeId)
	}

	// check sessmgrd.sock file existence
	sessMgrSockFilePath := filepath.Join(workDir, common.SessMgrSockFile)
	glog.Infof("Checking existence of file %s", sessMgrSockFilePath)
	retryLimit := 30
	var i int
	for i = 0; i < retryLimit; i++ {
		if _, err := os.Stat(sessMgrSockFilePath); err == nil {
			break
		}

		// err != nil
		if !os.IsNotExist(err) {
			glog.Errorf("fail to os.Stat sessmgr socket file %s", sessMgrSockFilePath)
		}
		time.Sleep(1 * time.Second)
	}

	if i >= retryLimit {
		return errors.New("timeout waiting for SessMgr Pod to be ready")
	}

	return nil
}