[Security] Blind write access could cause problems
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- typescript
Research direction
Start by reproducing the issue's question: test whether transcluding a tiddler or using a sequence of widgets can cause a wiki change in the MultiWikiServer scenario. Trace whether a student-controlled bag can write or expose tiddlers from other bags; done when the attack is confirmed or ruled out and the affected access boundary is documented.
Written by the indexing model from the issue text.
Description
@Jermolene @pmario
I've come across what I think may be a corner case, or may be something much more substantial. I'm not sure yet.
Consider the scenario where a teacher has a bag for each of his students which they can write to and he can read all their bags loaded in one recipe (maybe he enforces that they all name their tiddlers with some prefix, somehow, which is fairly easy to do with some minor UI tweaks).
Now each student has write access to one of the bags in the recipe, but cannot read most of them. However, a student may be able to come up with an attack which somehow allows them to modify their own bag in such a way that when the teacher loads his recipe, or clicks a button, or who knows what, it dumps all the tiddlers of all the students into that one student's bag.
Obviously the partitioned bags feature I keep talking about would enforce username prefixes at the server level to avoid trusting the user, and we can prevent bags from loading modules, so most of this can be mitigated quite well, but a few vectors may still be possible.
Question: Is there any sequence of widgets which would be able to cause a wiki change simply by transcluding a tiddler?
- Dominant language
- TypeScript
- Stars
- 60
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from TiddlyWiki/MultiWikiServer
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
TiddlyWiki/MultiWikiServer#140 · 4 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
TiddlyWiki/MultiWikiServer#139 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
TiddlyWiki/MultiWikiServer#138 ·
-
User creation fails with 500 error when email field is left blank - missing frontend validationOpen
Difficulty 4/5 3-5 days Newbie friendliness 48/100
TiddlyWiki/MultiWikiServer#136 · 1 reaction ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
TiddlyWiki/MultiWikiServer#135 · 1 comment ·
All issues in TiddlyWiki/MultiWikiServer
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
openwatersio/slackwater-database#281 ·
Maintainers usually reply within 1 day
-
accepted bug via-triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
pingdotgg/t3code#18690 · 1 comment ·
Maintainers usually reply within 1 day
-
Bayern feature:Application ready web
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
digitalfabrik/entitlementcard#3176 ·
Maintainers usually reply within 7 days
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
NanmiCoder/cc-haha#1533 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day