tranquil-pds
Our Personal Data Server from scratch! tranquil.farm
pds rust database fun oauth atproto
Star 546
Fork 39
Watch

fix(scopes): reject malformed scope params instead of widening the grant #685

Open trezy.codes
targeting main from trezy.codes/tranquil-pds:fix/scopes-reject-malformed-params
Open opened by and assigned to trezy.codes
targeting main from trezy.codes/tranquil-pds:fix/scopes-reject-malformed-params

A typo'd or valueless param could end up granting more than the scope asked for, instead of being rejected:

  • repo:app.bsky.feed.post?actionn=create → create, update, and delete
  • repo:app.bsky.feed.post?action → same
  • blob?acceptt=image/* → every mime type

The reference implementation grants nothing in these scenarios. We were dropping params without an = and ignoring unknown keys, so you'd just fall back to the "everything" default. Prefix matching also used starts_with, so blobbity counted as blob. 🙃

  • Unknown keys and valueless keys now reject the whole permission, same as the reference
  • Prefix matching is exact
  • Repeated aud is rejected, also matching the reference
  • repo's collection query param is rejected too, since ignoring it would grant every collection

rpc's lxm and account's action still take the first value, same as before. The reference actually honors all of them (multiple: true), but that's a much bigger change.

Commits 0