solid / solid/specification

Address workarounds that undermine access control, data validation, server-managed resources

Open
#175 2 comments 1 reaction 1 assignee View on GitHub

@justinwb is already working on this.

Since May 1, 2020.

topic: auxiliary resources
Dominant language
HTML
Stars
563
Forks
108
Avg merge
4d 13h
Merged PRs (30d)
3

Description

I'm not sure what would be the best way to frame this issue. For now: how to avoid (preferable by design) or dismiss (last resort) requests that can potentially get around the original affordances of a resource and associated resources. Here are some examples that fit this category but I'd suspect there's more that we can log in this issue:

In https://github.com/solid/specification/issues/145#issuecomment-618918284 , I've clarified how reinstating a resource can be a security issue based on the ACL inheritance algorithm. In https://github.com/solid/specification/issues/46#issuecomment-584089121 , @kjetilk suggested to prohibit URL reuse with 410 on deleted resources as an optional security feature.

In https://github.com/solid/specification/issues/174#issuecomment-618779578 , @acoburn raises an issue where a shape resource can be manipulated to bypass original (or prior) validation rules.

The same may hold for server-managed and configuration resources in that having Write on the resource that's making the association can alter what happens at the auxiliary resource. For example: resource links to server-managed where it describes agent-a as the creator. agent-b (having Write on resource) can delete and create the resource again, thereby changing the creator statement in server-managed resource.

The system has a local (microscopic) view of the interactions but given the side-effects there are global effects that we need to take into account.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.