René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Security: Default WAC mode changed from permissive to restrictive","articleBody":"## Summary\n\nWhen no ACL file exists for a resource, JSS was previously defaulting to allowing all access (permissive mode). This allowed unauthenticated users to POST arbitrary content to unprotected containers.\n\n## Attack Vector\n\n1. Attacker sends POST request to any container without an ACL\n2. JSS accepts the request and creates a file with attacker-controlled content\n3. This was observed in the wild with Next.js RCE exploit payloads (CVE-2024-34351 style attacks)\n\n## Fix\n\nChanged default behavior in `src/wac/checker.js`:\n- **Before**: No ACL = allow all access\n- **After**: No ACL = deny all access\n\n## Fixed in\n\nCommit f43ecdf\n\n## Action Required for Deployers\n\nEnsure a root `.acl` file exists in your data directory. Example (JSON-LD format):\n\n```json\n{\n  \"@context\": {\n    \"acl\": \"http://www.w3.org/ns/auth/acl#\",\n    \"foaf\": \"http://xmlns.com/foaf/0.1/\"\n  },\n  \"@graph\": [\n    {\n      \"@id\": \"#owner\",\n      \"@type\": \"acl:Authorization\",\n      \"acl:agent\": { \"@id\": \"https://your-domain.com/profile/card#me\" },\n      \"acl:accessTo\": { \"@id\": \"https://your-domain.com/\" },\n      \"acl:default\": { \"@id\": \"https://your-domain.com/\" },\n      \"acl:mode\": [\n        { \"@id\": \"acl:Read\" },\n        { \"@id\": \"acl:Write\" },\n        { \"@id\": \"acl:Control\" }\n      ]\n    },\n    {\n      \"@id\": \"#public\",\n      \"@type\": \"acl:Authorization\",\n      \"acl:agentClass\": { \"@id\": \"foaf:Agent\" },\n      \"acl:accessTo\": { \"@id\": \"https://your-domain.com/\" },\n      \"acl:default\": { \"@id\": \"https://your-domain.com/\" },\n      \"acl:mode\": [\n        { \"@id\": \"acl:Read\" }\n      ]\n    }\n  ]\n}\n```\n\n## Labels\n\nsecurity, breaking-change","author":{"url":"https://github.com/melvincarvalho","@type":"Person","name":"melvincarvalho"},"datePublished":"2026-01-03T17:06:36.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/32/JavaScriptSolidServer/issues/32"}