getContainerElements can return urls outside of the container
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 12
- Forks
- 13
- Avg merge
- 15h 15m
- Merged PRs (30d)
- 3
Description
I think intuitively the getContainerElements function should only return elements that have this folder as a parent (e.g. for /folder/ only /folder/* and not /other/). The current implementation allows any urls to be returned if the turtle file specifies this.
As an implication, when creating a folder with additional containment triples, these folders:
- recursive deletion can delete arbitrary urls (not tested, but the code looks like it would simply fetch all "contained" resources and then delete them, even if they are on a different server)
- are displayed to have children that could be arbitrary urls (tested, see below for an example)
Creating folders with additional containment triples is currently possible with ESS. Also note that it's not forbidden by the spec to add additional data when POSTing new folders, so it's something we should consider in the applications. An example turtle is following, which will display the public folder inside of confusion/:
@prefix ldp: <http://www.w3.org/ns/ldp#> .
@prefix me: <https://storage.inrupt.com/ba39f662-260a-415e-aee1-3290e3974092/reviews/confusion/> .
@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
me: rdf:type ldp:Container , ldp:BasicContainer ;
ldp:contains <https://sheep.solidcommunity.net/public/> .
Currently you can test this here, not sure how long I'll keep the link (note that it shows a folder of inrupt.com, but contains a child from solidcommunity.net): https://solidos.github.io/mashlib/dist/browse.html?uri=https%3A%2F%2Fstorage.inrupt.com%2Fba39f662-260a-415e-aee1-3290e3974092%2Freviews%2Fconfusion%2F
As a fix, I'd suggest that getContainerElements filters out urls that do not start with the container url. eg for the container https://example.org/public/ it should have the filter urls.filter(url => url.startsWith("https://example.org/public/")) (not sure how this looks like with rdflib objects).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/util/containerLogic.ts at getContainerElements and reproduce the behavior with the turtle example in the issue. Ensure the result includes only resources under the container URL, then verify that external URLs are excluded from the returned elements and cannot be treated as children.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100