7 ms·

I agree it would be user error, but it seems to be a particularly easy mistake to make compared to the REST example, where you explicitly create REST endpoint t

I agree it would be user error, but it seems to be a particularly easy mistake to make compared to the REST example, where you explicitly create REST endpoint to send a value to the client. If you accidentally move filtering of a list of users from server-scope to client-scope during refactoring, everything will still work just as you expect it to and you'll be none the wiser – but suddenly every user has access to all the user data in the list. There's not many other frameworks I'm aware of where moving an operation to an adjacent row or forgetting to change a word suddenly (and silently) exposes the data to the client – except perhaps PHP, which does not have a good reputation when it comes to security to say the least. Altough to be fair adlpz mentioned something similar with Next.js in another thread. Tagging values as server-only mostly seems like another thing that could be easily forgotten. Personally I would feel more comfortable if values intended to be sent from the server to client had to be explicitly tagged as mutual, with an optional compilation flag that enforces this, such that the intent to share it with the client must always be stated in plain text during creation.

butternoodle 4y ago
As a security guy I would say this situation happens with reasonable frequency in REST web frameworks where developers are encouraged to use ORMs[0], and the design of Hyperfiddle/Electric is no more likely to fall victim to it. I'd actually take a punt that it's less likely because of Clojure's data-orientation. Given that the above mentioned ORM-preferring frameworks typically have to define a whole new class and map the data from a server-side representation to a client-side representation, you're more likely to see developers not bother, forget or bungle the implementation aspect. What I'm interested in is how Electric Clojure handles mass assignment (unconstrained deserialization)[1], sort of the flip side of excessive data exposure. If an (e/server) s-exp uses the symbol `is-admin?` will the server respect or discard values for `is-admin?` sent from the client? [0] https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa3-excessive-data-exposure.md https://github.com/OWASP/API-Security/blob/master/2019/en/sr... [1] https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md https://github.com/OWASP/API-Security/blob/master/2019/en/sr...
- comma_at 4y ago
  The only way for the client to set a server-side symbol to a value is to explicitly request it in code (e/server (let [is-admin? (e/client ...)])) Even with mutable atoms you'd have to write the `reset!` on the server.

butternoodle 4y ago

As a security guy I would say this situation happens with reasonable frequency in REST web frameworks where developers are encouraged to use ORMs[0], and the design of Hyperfiddle/Electric is no more likely to fall victim to it. I'd actually take a punt that it's less likely because of Clojure's data-orientation. Given that the above mentioned ORM-preferring frameworks typically have to define a whole new class and map the data from a server-side representation to a client-side representation, you're more likely to see developers not bother, forget or bungle the implementation aspect. What I'm interested in is how Electric Clojure handles mass assignment (unconstrained deserialization)[1], sort of the flip side of excessive data exposure. If an (e/server) s-exp uses the symbol `is-admin?` will the server respect or discard values for `is-admin?` sent from the client? [0] https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa3-excessive-data-exposure.md https://github.com/OWASP/API-Security/blob/master/2019/en/sr... [1] https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa6-mass-assignment.md https://github.com/OWASP/API-Security/blob/master/2019/en/sr...

comma_at 4y ago
The only way for the client to set a server-side symbol to a value is to explicitly request it in code (e/server (let [is-admin? (e/client ...)])) Even with mutable atoms you'd have to write the `reset!` on the server.