SolidOS / solidos

The operating system for Solid
https://solidos.solidcommunity.net/
MIT License
127 stars 19 forks source link

Prevent user from creating profile file/html in localStorage #201

Open chunt007 opened 1 year ago

chunt007 commented 1 year ago

When I was creating a test.html file for solid-panes repository to render the html and fix XSS bugs, I may have accidentally created a profile.html file in the main storage folder. This file mirrors the actual profile in some way. It is also undeletable.

the card#me is crashed and does not function.

bourgeoa commented 1 year ago

@chunt007 The resources that where causing the issue where representing the following files : profile$.htm and profile$.ttl

I was able to reproduce the issue by creating a new resource test$.html. This resource is then stored as a 'test$.html file. Due to the resource mapping algorithm this file is retrieved as test resource.

In your case with profile' this went wrong. Solid do not allow container resource and document resource to have the same name. NSS should forbid this situation to occur. I suppose that NSS when creating profile$.ttl should check that the container resource profile did not exist The check was done with profile$