Skip to content

fix for security issue that allows bypassing the WAC with sparql patch; #69

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ylebre merged 1 commit into from
Nov 12, 2026
Merged

fix for security issue that allows bypassing the WAC with sparql patch; #69

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
111 changes: 84 additions & 27 deletions src/WAC.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -456,37 +456,94 @@ public function getRequestedGrants($request) {
$body = $request->getBody()->getContents();
$request->getBody()->rewind();

// FIXME: determine the actual patch types instead of using a string match;
if (strstr($body, "deletes")) {
$grants[] = array(
"type" => "resource",
"grants" => array('http://www.w3.org/ns/auth/acl#Write')
);
// To delete a triple from a resource, you need to be able to know that the triple is there.
// which requires Read;
$grants[] = array(
$resourceGrants = array();
$contentType= $request->getHeaderLine("Content-Type");
switch($contentType) {
case "application/sparql-update":
case "application/sparql-update-single-match":
// FIXME: determine the actual patch types instead of using a string match;
if (stristr($body, "delete data")) {
$resourceGrants[] = array(
"type" => "resource",
"grants" => array('http://www.w3.org/ns/auth/acl#Write')
);
// To delete a triple from a resource, you need to be able to know that the triple is there.
// which requires Read;
$resourceGrants[] = array(
"type" => "resource",
"grants" => array('http://www.w3.org/ns/auth/acl#Read')
);
}
if (stristr($body, "insert data")) {
if ($this->filesystem->fileExists($path)) {
$resourceGrants[] = array(
"type" => "resource",
"grants" => array(
'http://www.w3.org/ns/auth/acl#Append',
'http://www.w3.org/ns/auth/acl#Write'
)
);
} else {
$resourceGrants[] = array(
"type" => "resource",
"grants" => array(
'http://www.w3.org/ns/auth/acl#Write'
)
);
}
}
break;
case "text/n3":
// FIXME: determine the actual patch types instead of using a string match;
if (stristr($body, "deletes")) {
$resourceGrants[] = array(
"type" => "resource",
"grants" => array('http://www.w3.org/ns/auth/acl#Write')
);
// To delete a triple from a resource, you need to be able to know that the triple is there.
// which requires Read;
$resourceGrants[] = array(
"type" => "resource",
"grants" => array('http://www.w3.org/ns/auth/acl#Read')
);
}
if (stristr($body, "inserts")) {
if ($this->filesystem->fileExists($path)) {
$resourceGrants[] = array(
"type" => "resource",
"grants" => array(
'http://www.w3.org/ns/auth/acl#Append',
'http://www.w3.org/ns/auth/acl#Write'
)
);
} else {
$resourceGrants[] = array(
"type" => "resource",
"grants" => array(
'http://www.w3.org/ns/auth/acl#Write'
)
);
}
}
break;
}

if ($resourceGrants === []) {
// No grants were set in the check above, so we're not able to determine the minimal set;
$resourceGrants[] = array(
"type" => "resource",
"grants" => array('http://www.w3.org/ns/auth/acl#Read')
"grants" => array(
'http://www.w3.org/ns/auth/acl#Read',
'http://www.w3.org/ns/auth/acl#Write',
'http://www.w3.org/ns/auth/acl#Append'
)
);
}
if (strstr($body, "inserts")) {
if ($this->filesystem->fileExists($path)) {
$grants[] = array(
"type" => "resource",
"grants" => array(
'http://www.w3.org/ns/auth/acl#Append',
'http://www.w3.org/ns/auth/acl#Write'
)
);
} else {
$grants[] = array(
"type" => "resource",
"grants" => array(
'http://www.w3.org/ns/auth/acl#Write'
)
);
}

foreach ($resourceGrants as $grant) {
$grants[] = $grant;
}

return $grants;
break;
}
Expand Down
Loading