Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Url rewrite - validate input #828

Open
danielpeintner opened this issue Sep 15, 2022 · 1 comment
Open

Url rewrite - validate input #828

danielpeintner opened this issue Sep 15, 2022 · 1 comment
Labels
binding-http Issues related to http protocol binding enhancement New feature or request

Comments

@danielpeintner
Copy link
Member

I noticed this comment from @egekorkan :

Option 1 is not bad but we have to make sure that only relative URLs are used since the host part of the URL comes from the servient and not from the binding (which manages the forms href). There was previously a discussion about this at #632 . I propose to keep only one issue and move the comments from to the other.

I think that the PR missing the validation side. In my understanding, it is possible to write something like { "/properties/test" : "http://hello.com/test" }, which is something not desirable. Should we validate both In URI and out URI to be relative references? Maybe we can do this in a future PR.

Originally posted by @relu91 in #810 (comment)

@danielpeintner
Copy link
Member Author

I have the feeling that abusing it in any way is somewhat up to the user.

What if I want to use a different IP of the machine node-wot is not aware of. We would prohibit it. There might be other cases.
What are the main arguments why we should apply further checks?

@relu91 relu91 added enhancement New feature or request binding-http Issues related to http protocol binding labels Sep 22, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
binding-http Issues related to http protocol binding enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants