search

samvera / hyrax

Hyrax is a Ruby on Rails Engine built by the Samvera community. Hyrax provides a foundation for creating many different digital repository applications.
http://hyrax.samvera.org/
Apache License 2.0
185 stars 124 forks source link

Prevent objects with too short of ids from being created #2550

Open cjcolvar opened 6 years ago

cjcolvar commented 6 years ago

Too short of an id means an id that is shorter than the noid configuration or 8 characters which ever is shortest (https://github.com/samvera/hyrax/blob/master/lib/hyrax/configuration.rb#L444). If an object with too short of an id is created, directly contained objects will get the incorrect id due to a bug in translate_uri_to_id (https://github.com/samvera/hyrax/blob/master/lib/hyrax/configuration.rb#L442-L447). This could lead to corrupt data in fedora. This generally shouldn't happen because ids minted by Hyrax should be long enough but this could surface when manually assigning ids like in spec tests.

This might be tricky to fix in a backwards compatible way so the suggested interim fix is to guard against this case and raise an error when attempting to create an object with too short of an id. (Talked about on this tech call: https://wiki.duraspace.org/display/samvera/Samvera+Tech+Call+2018-01-24)

See https://github.com/samvera/hyrax/issues/2546 for more details.

no-reply commented 6 years ago

Thinking about this, I think the fix has to be first to guard against items with offending IDs being created, then to prevent them from being added to collections if they happen to exist. I'm not sure what, if anything, we can do if they are already in a collection. I presume this will be a too late kind of scenario where we'd need to provide guidance for impacted users.

I'll be looking at this ticket over the next few days, but also taking a peek at the underlying issue just in case the fix there looks achievable to me.

vantuyls commented 6 years ago

@no-reply status of this issue?