m-ld / m-ld-spec

Platform-independent m-ld specification
https://spec.m-ld.org/
MIT License
24 stars 1 forks source link

Constraint apply may affect unauthorised data #107

Open gsvarovsky opened 1 year ago

gsvarovsky commented 1 year ago

Noticed in security design.

In general, constraints may attempt to assert data to which the local user has no write access.

For example, a mandatory field constraint could attempt to re-instate a missing value upon receipt of a remote deletion.

Such an alteration is acceptable locally, but to remote clones receiving the constraint assertion, it appears that the local user is attempting an unauthorised operation.