Subject: Mount considerations

From: Lisa Dusseault <[email-masked]>
Date: Wed, 17 May 2006 18:12:16 -0700

Thinking about the DAV mount proposal (after posting on the CalDAV  
list), I started wondering if there's any real security consideration  
if the mount document is on a totally different server than the  
WebDAV collection.
  - Denial of service?  No different than any cross-site link to a  
WebDAV collection
  - Privacy? Possibly leaks username which is ordinarily not  
revealed.  Difficult to keep permissions synched with collection  
permissions.
  - Other?  (anyone?  what am I missing?)

I guess the only one of those that bears mentioning in the document  
is that servers would reveal information unnecessarily, and possibly  
irresponsibly, unless they were to apply the same ACL to the  
collection and to the mount document.

Lisa

---

From: Julian Reschke <[email-masked]>
Date: Thu, 18 May 2006 07:30:34 +0200

> Thinking about the DAV mount proposal (after posting on the CalDAV 

<http://greenbytes.de/tech/webdav/draft-reschke-webdav-mount-04.html>

> list), I started wondering if there's any real security consideration if 
> the mount document is on a totally different server than the WebDAV 
> collection.
>  - Denial of service?  No different than any cross-site link to a WebDAV 
> collection

Correct.

>  - Privacy? Possibly leaks username which is ordinarily not revealed.  

The username (optionally) is sent in the content from server to client 
(see 
<http://greenbytes.de/tech/webdav/draft-reschke-webdav-mount-04.html#ELEMENT_username>). 
In general, this is the user name that was used to authenticate to the 
Web site in the first place, so I'm not sure why sending it back to the 
client is any kind of security risk?

> Difficult to keep permissions synched with collection permissions.

What does this have to do with the act of mounting?

> I guess the only one of those that bears mentioning in the document is 
> that servers would reveal information unnecessarily, and possibly 
> irresponsibly, unless they were to apply the same ACL to the collection 
> and to the mount document.

I'm not sure what kind of information you're referring to here. Please 
be more specific...

Best regards, Julian

---

From: Lisa Dusseault <[email-masked]>
Date: Mon, 22 May 2006 16:06:35 -0400

On May 18, 2006, at 1:30 AM, Julian Reschke wrote:

>> list), I started wondering if there's any real security  
>> consideration if the mount document is on a totally different  
>> server than the WebDAV collection.
> The username (optionally) is sent in the content from server to  
> client (see <http://greenbytes.de/tech/webdav/draft-reschke-webdav- 
> mount-04.html#ELEMENT_username>). In general, this is the user name  
> that was used to authenticate to the Web site in the first place,  
> so I'm not sure why sending it back to the client is any kind of  
> security risk?

It's not obvious at all to me that the username I use to download the  
mount document is the same one my client used to authenticate to get  
the document.   That implies that the document is dynamically  
generated, always.   That makes it harder to deploy in some cases.

>> I guess the only one of those that bears mentioning in the  
>> document is that servers would reveal information unnecessarily,  
>> and possibly irresponsibly, unless they were to apply the same ACL  
>> to the collection and to the mount document.
>
> I'm not sure what kind of information you're referring to here.  
> Please be more specific...

Given my assumption that the username could be the one the client is  
using or some *other* username, there is at least a possibility of  
information leaking here.

Lisa

---

From: Julian Reschke <[email-masked]>
Date: Tue, 23 May 2006 20:42:35 +0200

Lisa Dusseault schrieb:
>> Web site in the first place, so I'm not sure why sending it back to 
>> the client is any kind of security risk?
> 
> mount document is the same one my client used to authenticate to get the 
> document.   That implies that the document is dynamically generated, 
> always.   That makes it harder to deploy in some cases.

Well, it depends on the use case. In general, I would expect it to be 
either dynamically generated, or not to have the username in it.

> information leaking here.

As there is with any other document type. I'm not sure where the 
security risk is here. That somebody can find out about usernames? These 
things also show up in lock properties, ACL properties, HTML content, 
whatnot...

Best regards, Julian