Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Prevent user from creating profile file/html in localStorage #201

Open
chunt007 opened this issue Mar 13, 2023 · 1 comment
Open

Prevent user from creating profile file/html in localStorage #201

chunt007 opened this issue Mar 13, 2023 · 1 comment
Assignees
Labels
bug Something isn't working

Comments

@chunt007
Copy link

chunt007 commented Mar 13, 2023

When I was creating a test.html file for solid-panes repository to render the html and fix XSS bugs, I may have accidentally created a profile.html file in the main storage folder. This file mirrors the actual profile in some way. It is also undeletable.

the card#me is crashed and does not function.

@bourgeoa
Copy link
Contributor

@chunt007
The resources that where causing the issue where representing the following files : profile$.htm and profile$.ttl

I was able to reproduce the issue by creating a new resource test$.html. This resource is then stored as a 'test$.html file.
Due to the resource mapping algorithm this file is retrieved as test resource.

In your case with profile' this went wrong. Solid do not allow container resource and document resource to have the same name.
NSS should forbid this situation to occur.
I suppose that NSS when creating profile$.ttl should check that the container resource profile did not exist
The check was done with profile$

@bourgeoa bourgeoa self-assigned this Mar 14, 2023
@bourgeoa bourgeoa added the bug Something isn't working label Mar 14, 2023
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
bug Something isn't working
Projects
Development

No branches or pull requests

2 participants