Subject: bind, inherited locks, and access control

From: "Tim Olsen" <[email-masked]>
Date: Thu, 11 Jan 2007 16:38:36 -0500

Hi,

Let's say a user has an infinite-depth lock on collection C.  There is
a resource R under a different collection for which the user does not
have DAV:write-content permission on (which is normally needed to
perform LOCK on).  Can the user BIND the resource R under C (thereby
having R inherit the lock) with only DAV:bind permission on C?  Or is
DAV:write-content permission also required on R ?

thanks,
Tim

---

From: Julian Reschke <[email-masked]>
Date: Thu, 11 Jan 2007 22:53:46 +0100

> DAV:write-content permission also required on R ?

I'm tempted to say "edge case", thus it depends.

A server could allow the BIND, but that wouldn't affect the permissions, 
thus the resource wouldn't suddenly become writable by somebody else.

Or it could reject the request.

The important thing here is that the BIND request can't be used work 
around the security model, which seems be the case in both cases.

Best regards, Julian

---

From: "Tim Olsen" <[email-masked]>
Date: Thu, 11 Jan 2007 19:15:38 -0500

> around the security model, which seems be the case in both cases.

But if the server allows the BIND then the user can exclusively lock
any resource just by binding it under a locked collection that he or
she owns.  Maybe it's best then to require DAV:write-content as well

-Tim

---

From: Stefan Eissing <[email-masked]>
Date: Fri, 12 Jan 2007 09:25:42 +0100

> she owns.  Maybe it's best then to require DAV:write-content as well

First, depth locks for BIND operations are crazy. Second, depth locks  
are a overblown idea anyway as of the personal opinion of yours  
truly. Third, what you describe seems to be a DoS by a (on almost all  
servers) authorized user.

I don't think this justifies as a reason to make the bind spec more  
complex.

Cheers,

Stefan

---

From: Julian Reschke <[email-masked]>
Date: Fri, 12 Jan 2007 10:09:41 +0100

Tim Olsen schrieb:
 > ...

Yep. I know that some people will say "interop" problem, so some more 
thoughts on this:

- As long as the server's behaviour doesn't cause a security problem, 
it's IMHO fine.

- If the request fails, the response body will tell the client why it 
didn (if compliant with RFC3744).

- Finally, this really has nothing to do with BIND. Replace BIND with 
MOVE and the same issue surfaces.

Best regards, Julian