Handle entity conditions on creation request consistently #145
Labels
bug/mistake potential
Further investigations may reveal invalid behavior or the likelyhood of incorrect library usage.
Milestone
Creating an entity (executing the "creation behaviors") is done in two steps: first the entity instance is created, second the instance is filled according to the creation request body. The second step is basically the same as executing an update on an existing entity and thus re-uses some of the corresponding interfaces and classes.
However, update behaviors allow to set a list of "entity conditions", which the entity must match the entity to be updated (i.e. before the update is done). Those entity conditions exist in the creation behaviors second step as well, but are currently ignored.
This may lead to a situation where creation behavior entity conditions are intentionally configured, but not executed, thus leading to a security hole.
There seem to be two approaches to solve the unused entity conditions in creation behaviors:
Comparing the approaches, 2. is heavily preferred, though more work to implement.
The text was updated successfully, but these errors were encountered: