On Thu, Jul 30, 2009 at 10:46 AM, Ian Boston<i...@tfd.co.uk> wrote: > Looking at [3], 2 things jump out. > 1. On post @typeHint gives a hint for the type of a property, If when > posting to a non existing resource you could pick up the resource type from > the post sling:resourceType POST parameter would it be possible to perform > the servlet resolution appropriately. Ie its still a non existing resource, > but it gets routed to the correct servlet ?
This is probably not safe, because if any resource type = script selector is injected from the outside, you can upload and run arbitrary scripts on the server, provided you have rights to modify content at one part of the repository (eg. /tmp for uploads). It is possible to restrict against such an attack by additional guarding (eg. restricting the script user, not allowing resource types located in /tmp), but the generality of this issue makes it easy to have a hole open in a running system. > 2. (slightly off track) when posting to /content/new/* a path generation > algorithm kicks in, being able to configure that algorithm might help with > some of the virtual cases (probably should talk about this in another > thread) :name and :nameHint are not enough? Regards, Alex -- Alexander Klimetschek alexander.klimetsc...@day.com
