Information exposure through Link header by guessing an allocated URI
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 38/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- javascript
Research direction
Trace the GET request handling and Link-header generation for existing versus missing paths. Compare unauthenticated and unauthorized requests to /foo/bar and /foo/baz; done means the Link header is consistently absent for those denied requests, with intended disclosure behavior covered by tests.
Written by the indexing model from the issue text.
Description
NSS responds to unauthenticated and unauthorized GET requests to /foo/bar (that exists) by including the HTTP header:
Link: <bar.acl>; rel="acl", <bar.meta> rel="describedBy", <http://www.w3.org/ns/ldp#Resource>; rel="type"
For GET requests to non-existing resources eg. /foo/baz, the response doesn't include the HTTP Link header.
Thus, the security consideration: existence of a resource can potentially be known by guessing or anticipating an allocated URI.
There are use cases where the server may want to reveal the information in the Link header in the response. If the server doesn't make the distinction between intentionally revealing and unintentionally exposing, the server is encouraged to minimize information leaking. So, in the case here, it should be consistent by omitting the Link header for unauthenticated and unauthorized requests.
- Dominant language
- JavaScript
- Stars
- 1.8k
- Forks
- 308
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from nodeSolidServer/node-solid-server
-
Difficulty 1/5 Under an hour Newbie friendliness 72/100
nodeSolidServer/node-solid-server#1848 · 2 comments · 1 reaction ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nodeSolidServer/node-solid-server#1841 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
nodeSolidServer/node-solid-server#1147 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
nodeSolidServer/node-solid-server#1867 ·
-
Difficulty 5/5 Over a week Newbie friendliness 45/100
nodeSolidServer/node-solid-server#1853 ·
All issues in nodeSolidServer/node-solid-server
Similar issues
-
ai-observability bug team/ai-observability
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
AllTheMods/ATM-10-L#19 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
SignalK/n2k-signalk#345 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 1/5 1-3 hours Newbie friendliness 88/100
JuliaPluto/PlutoPlotly.jl#72 ·