Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Require servers to prevent or sanitise HTML on write by default for unauthenticated users

Abierto
  • ¿Algo no está bien?
#515 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
30/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
html
Área
documentation, security

Línea de trabajo

Lee la sección de constraints y problem-details de Solid Protocol y compara este issue con #514, #1596 y la LDN specification. Determina si las especificaciones ya cubren las restricciones de escritura y append no autenticados; se considera terminado cuando existe un requisito normativo claro o una mitigación de seguridad documentada, incluida la cuestión de la ejecución de scripts.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

This issue complements #514, which focuses on serving html rather than writing of HTML. It also follows up on an implementation specific issue raised on https://github.com/CommunitySolidServer/CommunitySolidServer/issues/1596

The spec allows constraints to be specified (https://solidproject.org/TR/protocol#constraints-problem-details) but as far as I can tell does not currently require any constraints

At the moment the spec does not appear to prevent writing of HTML to a server by unauthenticated users in cases where public write or append permission has been granted.

Such permission is a useful part of an inbox, so it looks like this an issue for the LDN specification as well, but applies generally to writing to a server.

I believe a minimum requirement is for the spec to require that a server use constraints that by default prevent or sanitise executable code on write for unauthenticated users.

A stronger version would be that a server MUST apply security constraints to any resource exposed to write and append permissions by unauthenticated users.

Out of the box, we don't want to allow accumulation of spam documents with possible security risks, regardless of how their risk is mitigated when served or on the client side.

Depending on interpretation, this possibly also has implications for the question:
"Do features in this specification enable new script execution/loading mechanisms?"

Arguably the spec does enable new mechanisms for loading scripts into a server, and therefore into a privileged context from which new attack surfaces are possible.

If this issue is already somehow covered by the spec, it would be useful for the mitigation to be summarised in this or another security question.

Lenguaje dominante
HTML
Estrellas
563
Forks
112
Merge medio
4 d 21 h
PR fusionados (30 d)
3

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de solid/specification

Todos los issues de solid/specification

Issues similares

Más issues de Documentation

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.