nodeSolidServer / nodeSolidServer/node-solid-server
Able to access private files when logged in with a different account/provider, which has not been granted access
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.8k
- Forks
- 308
- PR merge metrics
- No merged PRs in 30d
Description
I appear to be able to read, and overwrite files with a PUT, files in a private folder when logged in to a different account.
The example I found is editing https://andydavison.inrupt.net/private/test.jpg when logged in with https://ldp.demo-ess.inrupt.com/andydavison/. According to the ‘Your storage’ tab at https://andydavison.inrupt.net/, that private folder is not shared with anyone else, and indeed is inaccessible when logged out from both providers.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the reported access using the two provider URLs, checking both reads and PUT requests to the private test.jpg file while logged in as the other account. Trace the authorization path for cross-provider access and verify that an account without sharing permission can neither read nor overwrite the private file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100