This repository was archived by the owner on Jan 4, 2020. It is now read-only.
This repository was archived by the owner on Jan 4, 2020. It is now read-only.
Should we enforce the IRI uniqueness test when an IRI is incrementally generated? #22
Description
Security concern: Incremental IRI generation is by definition highly predictable, while the RandomPrefixedIriGenerator is hard (but not impossible) to predict.
An attacker, that is able to create new object and to choose its IRI, can poison IN ADVANCE an object by assigning it assertions that will not be overwritten when this IRI will be allocated by the IRI generator.
Should we prevent it by forcing the IRI generator to make IRI uniqueness test? If so, IncrementalIriGenerator performance will decrease again and will favour the RandomPrefixedIriGenerator as the recommended IRI generator.