On Wednesday, April 28, 2010 11:57:57 Rolf Eike Beer wrote:
> Am Mittwoch 28 April 2010 07:06:35 schrieb Dawit A:
> > What was surprising here is that the above solution can be implemented
> > very easily. With only one additional requirement to qualify meta-data
> > as internal, we can use the existing method that ioslaves use to send
> > meta-data back to applications to solve the issue. What is this
> > requirement ? We simply state/assume that a meta-data whose key starts
> > with the keyword
> > "_kio_internal_" will be treated as an internal meta-data and handled
> > separately from the regular meta-data container that holds values slated
> > to be sent to applications. You can read the details of how this is
> > supposed to work by either reading the attached patch or simply reading
> > the changes I made to the DESIGN.metadata document which is included
> > with the patch.
> 
> I suggest using something that must not be a valid metadata identifier.
> E.g. starting things with some (printable, ASCII) special character like
> space, # or whatever. That way we can avoid that a server can inject such
> things into the metadata cache. Otherwise you would have to filter out any
> metadata from the server that starts with _kio_internal to make sure it
> doesn't try to fool us into something.

hmm... an interesting point but one that really does not apply in this case. 
If I understand it correctly, your concern is that a server will be able 
inject meta-data and force the ioslave to send it credentials it should not, 
correct ?

Well that cannot happen for two reasons:

#1. I do not have any plans to send credential information through the meta-
data system! That is the most ludicrous thing to do but somehow my explanation 
of the system seems to be interpreted as such. See my response to Andreas's 
email to understand my intent better. Granted within reason an ioslave will 
now be able to send meta-data to another ioslave. Still what you fear cannot 
happen even if that is the case. See below as to why.

#2. No ioslave developer in their rightful minds would directly translate a 
server response into KIO meta-data key! It makes no sense to do that at all!
It is the responsibility of the ioslave writers to take care of this 
particular issue. Anyhow, even if they do not a server cannot still 
credentials as you fear because of #1.

Perhaps, I should have included the kio_http patch with this post. Maybe that 
would have reduced the confusion about how this was intended to be 
implemented. 

Regards,
Dawit A.