Mirroristas/CommunitySolidServer
2
0
Fork 0
mirror of https://github.com/CommunitySolidServer/CommunitySolidServer.git synced 2024-10-03 14:55:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: Prevent access to internal storage containers

Browse Source
This commit is contained in:
Joachim Van Herwegen 2021-07-27 13:27:31 +02:00
parent f4833d2534
commit 7b94b71e7e
9 changed files with 27 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/default.json
View File

@ -19,7 +19,7 @@
"files-scs:config/ldp/metadata-writer/default.json",
"files-scs:config/ldp/permissions/acl.json",
"files-scs:config/storage/backend/memory.json",
"files-scs:config/storage/key-value/memory.json",
"files-scs:config/storage/key-value/resource-store.json",
"files-scs:config/storage/middleware/default.json",
"files-scs:config/util/auxiliary/acl.json",
"files-scs:config/util/identifiers/suffix.json",

2
config/dynamic.json
View File

@ -19,7 +19,7 @@
"files-scs:config/ldp/metadata-writer/default.json",
"files-scs:config/ldp/permissions/acl.json",
"files-scs:config/storage/backend/dynamic.json",
"files-scs:config/storage/key-value/memory.json",
"files-scs:config/storage/key-value/resource-store.json",
"files-scs:config/storage/middleware/default.json",
"files-scs:config/util/auxiliary/acl.json",
"files-scs:config/util/identifiers/suffix.json",

2
config/example-https-file.json
View File

@ -19,7 +19,7 @@
"files-scs:config/ldp/metadata-writer/default.json",
"files-scs:config/ldp/permissions/acl.json",
"files-scs:config/storage/backend/file.json",
"files-scs:config/storage/key-value/memory.json",
"files-scs:config/storage/key-value/resource-store.json",
"files-scs:config/storage/middleware/default.json",
"files-scs:config/util/auxiliary/acl.json",
"files-scs:config/util/identifiers/suffix.json",

2
config/file.json
View File

@ -19,7 +19,7 @@
"files-scs:config/ldp/metadata-writer/default.json",
"files-scs:config/ldp/permissions/acl.json",
"files-scs:config/storage/backend/file.json",
"files-scs:config/storage/key-value/memory.json",
"files-scs:config/storage/key-value/resource-store.json",
"files-scs:config/storage/middleware/default.json",
"files-scs:config/util/auxiliary/acl.json",
"files-scs:config/util/identifiers/suffix.json",

6
config/ldp/authorization/webacl.json
View File

@ -9,6 +9,12 @@
"@id": "urn:solid-server:default:Authorizer",
"@type": "WaterfallHandler",
"handlers": [
{
"comment": "This authorizer will be used to prevent external access to containers used for internal storage.",
"@id": "urn:solid-server:default:PathBasedAuthorizer",
"@type": "PathBasedAuthorizer",
"baseUrl": { "@id": "urn:solid-server:default:variable:baseUrl" }
},
{
"comment": "This authorizer makes sure that for auxiliary resources, the main authorizer gets called with the associated identifier.",
"@type": "AuxiliaryAuthorizer",

2
config/memory-subdomains.json
View File

@ -19,7 +19,7 @@
"files-scs:config/ldp/metadata-writer/default.json",
"files-scs:config/ldp/permissions/acl.json",
"files-scs:config/storage/backend/memory.json",
"files-scs:config/storage/key-value/memory.json",
"files-scs:config/storage/key-value/resource-store.json",
"files-scs:config/storage/middleware/default.json",
"files-scs:config/util/auxiliary/acl.json",
"files-scs:config/util/identifiers/subdomain.json",

2
config/path-routing.json
View File

@ -19,7 +19,7 @@
"files-scs:config/ldp/metadata-writer/default.json",
"files-scs:config/ldp/permissions/acl.json",
"files-scs:config/storage/backend/regex.json",
"files-scs:config/storage/key-value/memory.json",
"files-scs:config/storage/key-value/resource-store.json",
"files-scs:config/storage/middleware/default.json",
"files-scs:config/util/auxiliary/acl.json",
"files-scs:config/util/identifiers/suffix.json",

2
config/sparql-endpoint.json
View File

@ -19,7 +19,7 @@
"files-scs:config/ldp/metadata-writer/default.json",
"files-scs:config/ldp/permissions/acl.json",
"files-scs:config/storage/backend/sparql.json",
"files-scs:config/storage/key-value/memory.json",
"files-scs:config/storage/key-value/resource-store.json",
"files-scs:config/storage/middleware/default.json",
"files-scs:config/util/auxiliary/acl.json",
"files-scs:config/util/identifiers/suffix.json",

14
config/storage/key-value/resource-store.json
View File

@ -22,6 +22,20 @@
"source": { "@id": "urn:solid-server:default:ResourceStore" },
"baseUrl": { "@id": "urn:solid-server:default:variable:baseUrl" },
"container": "/idp/data/"
},
{
"comment": "Block external access to the storage containers to avoid exposing internal data.",
"@id": "urn:solid-server:default:PathBasedAuthorizer",
"PathBasedAuthorizer:_paths": [
{
"PathBasedAuthorizer:_paths_key": "^/locks(/.*)?$",
"PathBasedAuthorizer:_paths_value": { "@type": "DenyAllAuthorizer" }
},
{
"PathBasedAuthorizer:_paths_key": "^/idp/data(/.*)?$",
"PathBasedAuthorizer:_paths_value": { "@type": "DenyAllAuthorizer" }
}
]
}
]
}