SolidOS / SolidOS/solid-logic

getContainerElements can return urls outside of the container

Open
#62 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
12
Forks
13
Avg merge
15h 15m
Merged PRs (30d)
3

Description

I think intuitively the getContainerElements function should only return elements that have this folder as a parent (e.g. for /folder/ only /folder/* and not /other/). The current implementation allows any urls to be returned if the turtle file specifies this.

As an implication, when creating a folder with additional containment triples, these folders:

  • recursive deletion can delete arbitrary urls (not tested, but the code looks like it would simply fetch all "contained" resources and then delete them, even if they are on a different server)
  • are displayed to have children that could be arbitrary urls (tested, see below for an example)

Creating folders with additional containment triples is currently possible with ESS. Also note that it's not forbidden by the spec to add additional data when POSTing new folders, so it's something we should consider in the applications. An example turtle is following, which will display the public folder inside of confusion/:

@prefix ldp:  <http://www.w3.org/ns/ldp#> .
@prefix me:   <https://storage.inrupt.com/ba39f662-260a-415e-aee1-3290e3974092/reviews/confusion/> .
@prefix rdf:  <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .

me:     rdf:type      ldp:Container , ldp:BasicContainer ;
        ldp:contains  <https://sheep.solidcommunity.net/public/> .

Currently you can test this here, not sure how long I'll keep the link (note that it shows a folder of inrupt.com, but contains a child from solidcommunity.net): https://solidos.github.io/mashlib/dist/browse.html?uri=https%3A%2F%2Fstorage.inrupt.com%2Fba39f662-260a-415e-aee1-3290e3974092%2Freviews%2Fconfusion%2F

As a fix, I'd suggest that getContainerElements filters out urls that do not start with the container url. eg for the container https://example.org/public/ it should have the filter urls.filter(url => url.startsWith("https://example.org/public/")) (not sure how this looks like with rdflib objects).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/util/containerLogic.ts at getContainerElements and reproduce the behavior with the turtle example in the issue. Ensure the result includes only resources under the container URL, then verify that external URLs are excluded from the returned elements and cannot be treated as children.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.