Comments (4)
This is a dangerous situation with security implications. Let's up this to critical level.
from cdn.
It's well known problem.
We are using md5 hash as a ID for files. Even if we will add new filename to the artifact when it's uploaded, we can't use it for downloading.
If user request download by ID and we have several name for this artifact, which filename should we provide for downloaded file?
To solve this problem we need to change ID to some unique value and migrate hashes to the separate field. But it is significant changes that will require changes in all other products.
@akarasulu btw, why did you marked it as critical
and security
? There is nothing about security here.
from cdn.
The problem here is that we did NOT design this to be multi-tenant and consider the potential collisions. This is left over craptoxiticity (just made up the word :D ) from Kurjun shit. We can fix this I am sure. Let me respond to your comments:
It's well known problem.
We still need to fix it.
We are using md5 hash as a ID for files. Even if we will add new filename to the artifact when it's uploaded, we can't use it for downloading.
We should not be using an identifier that cannot clash across users. I would use treat each upload as unique. So all artifacts uploaded in the system, even same files, should be linked to a unique primary key: UUID of the uploaded artifact. The md5 should still be used but as a secondary key which will produce duplicates.
Even the same thing uploaded twice by other people will be treated differently this way.
If user request download by ID and we have several name for this artifact, which filename should we provide for downloaded file? To solve this problem we need to change ID to some unique value and migrate hashes to the separate field. But it is significant changes that will require changes in all other products.
BTW I agree 100% with you.
YES unfortunately. This is the cost of early mistakes in the design.
@akarasulu btw, why did you marked it as critical and security? There is nothing about security here.
Sure let me explain. When one user can interfere with another users' shit in the system this falls under a security concern for me. It has security implications.
from cdn.
Is there currently any documentation on Gorjun?
If not can we get some basic information up here on the wiki?
Would also be nice to have a list of all the REST API endpoints.
I want to start working on how we can specify it properly going forward.
from cdn.
Related Issues (20)
- Move functions to a refactored CDN
- Fix missing BP icons on CDN HOT 2
- Implement unit tests on refactored CDN
- Fix the filter by name on CDN page HOT 2
- Add verified parameter to list HOT 3
- Increase test coverage of retrieve.go to 100%
- Increase test coverage of server/app/upload.go to 100% HOT 1
- Write script for checking if all files are that are present in ../repo/list exist in file system on all CDNs HOT 1
- Add new-formatted Download callback
- Add a Delete functionality in refactored CDN
- Transfer Authorization functions to refactored CDN
- Transfer Share function to refactored CDN
- Can't see Packages file on CDN
- Storm ORM Integration: PrepareQuery HOT 1
- Storm ORM Integration: GetFileInfo HOT 1
- Storm ORM Integration: GetUserInfo HOT 1
- Storm ORM Integration: DeleteFile HOT 1
- Storm ORM Integration: GetToken HOT 1
- Storm ORM Integration: ShareFile HOT 1
- Storm ORM Integration: ConvertFiletoOld HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cdn.