solid / solid/data-interoperability-panel

Contradictory or inconsistent statements

Open
#154 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Bikeshed
Stars
58
Forks
18
PR merge metrics
No merged PRs in 30d

Description

There's a problem that I've been thinking about that perhaps this panel might address: The potential for making statements that are contradictory to some central ideas of Solid. The simplest such example would be:

<> a ldp:NonRDFSource .

i.e. to say in RDF that the present resource is a not RDF. You could also have resources where the request itself is internally inconsistent between headers and body, e.g.:

PUT /foo HTTP/1.1
Content-Type: text/turtle
Link: <http://www.w3.org/ns/ldp#RDFSource>; rel="type"

@prefix ldp: <http://www.w3.org/ns/ldp#> .
<> a ldp:BasicContainer ;
     ldp:contains </bar/> .

This says that it is not a container, since the request URI does not end with a / and the headers are consistent (see https://github.com/solid/specification/issues/301 ), but the body is really sneaky, because it tries to act as a container. I imagine that this is the kind of thing that attackers might try to confuse access control or something. I therefore think we should reject such things in a validation step.

It gets tricky, because I also think that the server should mainly concern itself with headers when deciding to reject or accept a request, but this makes it possible to add stuff that more body-oriented systems would find confusing.

I think this fits well with other validation-oriented work.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading this issue alongside Solid specification issue #301 and the LDP constraints described in the examples. The work is done when the panel has agreed on whether headers and RDF bodies must be cross-validated and has specified clear rejection criteria for contradictory requests.

Written by the indexing model from the issue text.

Assessment

Domain
backend-api-design, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.