createAclFromFallbackAcl copies over a default block that confuses NSS

[RubenVerborgh]

When using createAclFromFallbackAcl on a document, it copies over acl:default triples (which only apply to containers), which it seems to do so by creating separate blocks for acl:accessTo and acl:default.
This confuses NSS, which then blocks access to the document under certain circumstances.

[Vinnl]

Thanks for reporting that Ruben. As far as I can see it should add both acl:accessTo and acl:default to the same Rule, so that's something to investigate indeed.

I suppose we should also report this as a bug against NSS? Even with the creation of separate Rules, I don't see anything in the spec that says that that shouldn't work, I think?

[RubenVerborgh]

I suppose we should also report this as a bug against NSS?

Yes: nodeSolidServer/node-solid-server#1596

However, the "circumstances" mentioned above are hard to reproduce, so probably a lot of effort to fix there.

[bourgeoa]

I do not understand why createAclFromFallbackAcl do not filter out acl:default predicate when creating a non container ACL.

Anyhow can under certain circumstances be more explicit or at least have an example of the ACL created.

[RubenVerborgh]

I do not understand why createAclFromFallbackAcl do not filter out acl:default predicate when creating a non container ACL.

It probably doesn't know whether it's creating an ACL for a document or a container without making a network request first.

Anyhow can under certain circumstances be more explicit or at least have an example of the ACL created.

Unfortunately, I'm just the messenger here. I've observed the bug happen in someone else's environment, and saw that removing default made it work. The root cause is that the ACL parsing code is not very optimal, I'm afraid.

[bourgeoa]

It probably doesn't know whether it's creating an ACL for a document or a container without making a network request first.

This is not possible the acl:accessTo object points to a document or a container.

[RubenVerborgh]

It probably doesn't know whether it's creating an ACL for a document or a container without making a network request first.

This is not possible the acl:accessTo object points to a document or a container.

Indeed. And how do you find out which of those that is? You ask the server 🙂

[bourgeoa]

You can use the / semantic which is a MUST

[RubenVerborgh]

The server normalizes though. Not sure how strictly we are enforcing yet.

[bourgeoa]

Since PUT to create a container has been added to NSS a strict enforcement of / semantic has been implemented. No example of missing case has been reported either by test or user, but never say never.