open-nomad/.changelog/15012.txt

```release-note:security
variables: Fixed a bug where non-sensitive variable metadata (paths and raft indexes) was exposed via the template `nomadVarList` function to other jobs in the same namespace.
```

```release-note:bug
variables: Fixed a bug where getting empty results from listing variables resulted in a permission denied error.
```
Merge release 1.4.2 files Changelog updates for 1.4.2 and backports. 2022-10-27 16:05:31 +00:00			```release-note:security
variables: fix filter on List RPC The List RPC correctly authorized against the prefix argument. But when filtering results underneath the prefix, it only checked authorization for standard ACL tokens and not Workload Identity. This results in WI tokens being able to read List results (metadata only: variable paths and timestamps) for variables under the `nomad/` prefix that belong to other jobs in the same namespace. Fixes the filtering and split the `handleMixedAuthEndpoint` function into separate authentication and authorization steps so that we don't need to re-verify the claim token on each filtered object. Also includes: * update semgrep rule for mixed auth endpoints * variables: List returns empty set when all results are filtered 2022-10-18 20:43:59 +00:00			variables: Fixed a bug where non-sensitive variable metadata (paths and raft indexes) was exposed via the template `nomadVarList` function to other jobs in the same namespace.
			```

Merge release 1.4.2 files Changelog updates for 1.4.2 and backports. 2022-10-27 16:05:31 +00:00			```release-note:bug
variables: fix filter on List RPC The List RPC correctly authorized against the prefix argument. But when filtering results underneath the prefix, it only checked authorization for standard ACL tokens and not Workload Identity. This results in WI tokens being able to read List results (metadata only: variable paths and timestamps) for variables under the `nomad/` prefix that belong to other jobs in the same namespace. Fixes the filtering and split the `handleMixedAuthEndpoint` function into separate authentication and authorization steps so that we don't need to re-verify the claim token on each filtered object. Also includes: * update semgrep rule for mixed auth endpoints * variables: List returns empty set when all results are filtered 2022-10-18 20:43:59 +00:00			`variables: Fixed a bug where getting empty results from listing variables resulted in a permission denied error.`
			```