You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@sling.apache.org by Davide <ge...@gmail.com> on 2012/06/11 15:03:47 UTC
"securing" SlingPostServlet
(please note the quotes around securing).
I really love the SlingPostServlet and the fact that I can create JCR
structure starting from a JSON stream. It really ease the process for
creating (and updating?) content.
Now if I'd go for the usage of it, I'd like to prevent some malicious
teenager to use curl commands to POST fake/not-correct content to the
repository.
I know that I can restrict it with user/password but what if he has the
right credentials?
Are there any way to restrict the operations allowed by the PostServlet?
Enforcing some content structures?
Prevent "flooding"?
Cheers
Davide
Re: "securing" SlingPostServlet
Posted by Eric Norman <er...@gmail.com>.
I usually try to avoid using the nt:unstructured node type (and anything
similar) to prevent issues where an authorized user is able to add
unexpected content to the repository.
If you define JCR node types you can explicitly declare what properties and
child nodes are allowed along with some simple constraints.
Then I also usually register a POST servlet for each of the custom JCR node
types that does some pre-validation of the submitted request parameters.
If any of the validation fails, you can forward back to the original page
to display the validation errors. If validation passes, you can just
forward the request on to the default sling POST servlet to do the rest of
the work.
Regards,
Eric
On Tue, Jun 12, 2012 at 2:07 AM, Davide <ge...@gmail.com> wrote:
> On 12/06/2012 07:13, Carsten Ziegeler wrote:
> > Another solution is to not rely on the Sling post servlet but write
> > special post scripts for the resource types you want to support.
>
> Thanks everyone for the suggestions.
>
> My rough idea was to use the JSON import for creating the initial
> strucuture. Let's call it "1st POST". Then using the
> resourceTypes+selectors+POST to update the already existing structures
> (2nd POSTs).
>
> About the user having the rights and messing with the data it's always
> possible. I'd just like to reduce the risk of people messing around just
> for fun.
>
> > Btw, I still think that we need something in this area - along with
> > better validation. I started a prototype long time ago, but never got
> > it to a point to share it. But I plan to have something for the next
> > adaptTo in September...
>
> I'll give a look at all the suggestions but I really think that Sling
> should provide some "security" mechanism against misusage of PostServlet.
>
> Cheers
> davide
>
>
Re: "securing" SlingPostServlet
Posted by Davide <ge...@gmail.com>.
On 12/06/2012 07:13, Carsten Ziegeler wrote:
> Another solution is to not rely on the Sling post servlet but write
> special post scripts for the resource types you want to support.
Thanks everyone for the suggestions.
My rough idea was to use the JSON import for creating the initial
strucuture. Let's call it "1st POST". Then using the
resourceTypes+selectors+POST to update the already existing structures
(2nd POSTs).
About the user having the rights and messing with the data it's always
possible. I'd just like to reduce the risk of people messing around just
for fun.
> Btw, I still think that we need something in this area - along with
> better validation. I started a prototype long time ago, but never got
> it to a point to share it. But I plan to have something for the next
> adaptTo in September...
I'll give a look at all the suggestions but I really think that Sling
should provide some "security" mechanism against misusage of PostServlet.
Cheers
davide
Re: "securing" SlingPostServlet
Posted by Carsten Ziegeler <cz...@apache.org>.
Another solution is to not rely on the Sling post servlet but write
special post scripts for the resource types you want to support.
Btw, I still think that we need something in this area - along with
better validation. I started a prototype long time ago, but never got
it to a point to share it. But I plan to have something for the next
adaptTo in September...
Regards
Carsten
2012/6/11 Justin Edelson <ju...@gmail.com>:
> Hi,
>
> On Jun 11, 2012, at 1:04 PM, Felix Meschberger <fm...@adobe.com> wrote:
>
>> Hi,
>>
>> Am 11.06.2012 um 09:03 schrieb Davide:
>>
>>> (please note the quotes around securing).
>>>
>>> I really love the SlingPostServlet and the fact that I can create JCR
>>> structure starting from a JSON stream. It really ease the process for
>>> creating (and updating?) content.
>>>
>>> Now if I'd go for the usage of it, I'd like to prevent some malicious
>>> teenager to use curl commands to POST fake/not-correct content to the
>>> repository.
>>>
>>> I know that I can restrict it with user/password but what if he has the
>>> right credentials?
>>
>> Access control is the way to go.
>>
>> If an attacker has knowledge of credentials to write to the repository, you have a problem to solve ;-)
>>
>>>
>>> Are there any way to restrict the operations allowed by the PostServlet?
>>
>> None, other than access control on the content
>>
>>>
>>> Enforcing some content structures?
>>
>> No.
>
> You could potentially do this with a PostProcessor.
>
> Justin
>
>>
>>>
>>> Prevent "flooding"?
>>
>> No, such mechanisms might make sense, but we don't have them
>>
>> Regards
>> Fleix
>>
>>>
>>> Cheers
>>> Davide
>>>
>>
--
Carsten Ziegeler
cziegeler@apache.org
Re: "securing" SlingPostServlet
Posted by Justin Edelson <ju...@gmail.com>.
Hi,
On Jun 11, 2012, at 1:04 PM, Felix Meschberger <fm...@adobe.com> wrote:
> Hi,
>
> Am 11.06.2012 um 09:03 schrieb Davide:
>
>> (please note the quotes around securing).
>>
>> I really love the SlingPostServlet and the fact that I can create JCR
>> structure starting from a JSON stream. It really ease the process for
>> creating (and updating?) content.
>>
>> Now if I'd go for the usage of it, I'd like to prevent some malicious
>> teenager to use curl commands to POST fake/not-correct content to the
>> repository.
>>
>> I know that I can restrict it with user/password but what if he has the
>> right credentials?
>
> Access control is the way to go.
>
> If an attacker has knowledge of credentials to write to the repository, you have a problem to solve ;-)
>
>>
>> Are there any way to restrict the operations allowed by the PostServlet?
>
> None, other than access control on the content
>
>>
>> Enforcing some content structures?
>
> No.
You could potentially do this with a PostProcessor.
Justin
>
>>
>> Prevent "flooding"?
>
> No, such mechanisms might make sense, but we don't have them
>
> Regards
> Fleix
>
>>
>> Cheers
>> Davide
>>
>
Re: "securing" SlingPostServlet
Posted by Felix Meschberger <fm...@adobe.com>.
Hi,
Am 11.06.2012 um 09:03 schrieb Davide:
> (please note the quotes around securing).
>
> I really love the SlingPostServlet and the fact that I can create JCR
> structure starting from a JSON stream. It really ease the process for
> creating (and updating?) content.
>
> Now if I'd go for the usage of it, I'd like to prevent some malicious
> teenager to use curl commands to POST fake/not-correct content to the
> repository.
>
> I know that I can restrict it with user/password but what if he has the
> right credentials?
Access control is the way to go.
If an attacker has knowledge of credentials to write to the repository, you have a problem to solve ;-)
>
> Are there any way to restrict the operations allowed by the PostServlet?
None, other than access control on the content
>
> Enforcing some content structures?
No.
>
> Prevent "flooding"?
No, such mechanisms might make sense, but we don't have them
Regards
Fleix
>
> Cheers
> Davide
>