Skip to content
This repository has been archived by the owner on Jan 4, 2020. It is now read-only.

Should we enforce the IRI uniqueness test when an IRI is incrementally generated? #22

Open
bcogrel opened this issue May 29, 2014 · 0 comments
Labels

Comments

@bcogrel
Copy link
Member

bcogrel commented May 29, 2014

Security concern: Incremental IRI generation is by definition highly predictable, while the RandomPrefixedIriGenerator is hard (but not impossible) to predict.

An attacker, that is able to create new object and to choose its IRI, can poison IN ADVANCE an object by assigning it assertions that will not be overwritten when this IRI will be allocated by the IRI generator.

Should we prevent it by forcing the IRI generator to make IRI uniqueness test? If so, IncrementalIriGenerator performance will decrease again and will favour the RandomPrefixedIriGenerator as the recommended IRI generator.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

1 participant