A client-supplied identity must not address an existing object

[rubenvdlinde]

Pre-existing. Found by sweeping the defect class from #1687, not from a report. Proven on a running instance before and after the fix.

The defect

ObjectService::saveObject() does not take its target as an argument the caller controls:

$providedId = $object['@self']['id'] ?? $object['id'] ?? null;

A match is treated as the uuid to UPDATE, and the write is PUT-semantic, so keys the payload omits are nulled.

Seven controllers build their payload from $this->request->getParams(). Several already stripped id for exactly this reason — the intent was right — but none stripped @self, which is the key saveObject reads first.

Measured, not reasoned

Against the mandate-roles create endpoint:

POST /api/mandate/rollen   {"roleName": "...", "@self": {"id": <victim uuid>}}
 -> 201, and the created id IS the victim's uuid
 -> the victim's row now holds the attacker's values

Any authenticated user could replace an arbitrary object of that schema, through an endpoint whose entire job is to create one.

The fix

Mostly central. ConfiguredRegistryService::save() already takes $id for the update case, so the payload's identity is stripped there and that parameter becomes the only way to address an existing object — which is what it was always for. Controllers that do not route through that service get the same strip at their own client boundary.

NrcController was checked and deliberately left alone: it echoes the body back in a response and writes nothing.

Evidence, in the order taken

1. The live exploit above.
2. A unit test with a negative control — removing the strip fails both new tests.
3. A second test that the explicit $id still updates, so the guard cannot have traded a security hole for silent duplication.
4. The same live exploit re-run against the fixed code:

{ "attackerGotDifferentId": true,
  "victimNameNow": "VICTIM2-original",
  "VERDICT": "SAFE — victim untouched, attacker got a new object" }

2769 tests, phpcs clean.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/dossiq @ ae0dc7a

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue3-compile		✅
test-l10n		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 106/106
npm			✅	✅ 540/540
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-02 19:29 UTC

Download the full PDF report from the workflow artifacts.