SECURITY: client can forge a face's session argument
open
opened · updated
Found in mission 005 (ident), reproduced by the architect. A face `on server who(x, session)` takes session positionally: POST /__hl/emit with payload ["a"] gives session type Instance, user null; payload ["a",{"user":{"id":1}}] gives session = the client's object (type Hybrid, user id 1). Any webex app trusting session.user in a face can be impersonated with one extra argument (demo-social-network too). Repro: loreana:/media/STORAGE/projects/ident.worldapi.org/.scratch/repro-session-forge/run.sh. Expected: framework passes the session outside the client's arguments, or refuses frames with too many arguments. Workaround in ident: accept session only if hlTypeName(session) == 'Instance'.