Indirect Object References

[christoferjennings]

Does SmartClient / SmartGWT handle the "indirect object reference" vulnerability?

The concept is that if a user cannot see something in the app then they should not be able to reference it by ID in any way. For example...
- Given system has type Foo with 2 instances, "A" with ID 1 and "B" with ID 2.
- Given User Bob cannot see Foo A.
- User Bob should only see Foo B in an options list.
- AND a request from Bob to associate Foo with ID 1 should be denied.

I can imagine making a DMI that stores IDs for Foo in the user session as requested by Bob. Then a validator could assure only Foo IDs that have been given to Bob can be accepted from Bob. Is this a good approach or does the framework already have something like it?

Reference: https://www.owasp.org/index.php/Top_10_2010-A4-Insecure_Direct_Object_References

Thanks!
,Chris
SmartClient version: v9.0p_2013-07-11EVAL

[Isomorphic]

That's a bit of an overwrought way of talking about an ordinary coding bug :)

But we do make scoping data to particular users about as easy as it can be - see this sample.

[christoferjennings]

Thanks for the link.
The page mentions the cartItem.ds.xml but it's not in the source popup. I assume it's a basic operation binding, but can you provide the source for reference?
Thanks,

So ... using a DMI is the right approach. Right?

Thanks 2,
,chris

[Isomorphic]

The SmartClient (Javascript-based) version of the example shows the source for the Cart datasource XML file.
http://smartclient.com/#SQLuserSpecificData

We'll fix the SmartGWT sample to show the source too.