A federated create may not address an existing object, and the organisation pin did not hold

[rubenvdlinde]

Found sweeping a defect class out of dossiq (ConductionNL/dossiq#1687, #1690). Two holes in one line, and the second is the one that line was written to prevent.

The line

FederationController::createObject() is #[PublicPage], #[NoCSRFRequired], and calls saveObject() with _rbac: false and _multitenancy: false — so nothing downstream refuses what it lets through.

$data['@self'] = (($data['@self'] ?? []) + ['organisation' => $share->getOrganisation()]);

PHP's + keeps the left operand's keys. For a caller holding a writable share token:

1. @self.id survived. saveObject() resolves its target from the payload — extractUuidAndNormalizeObject() reads @self.id first, then id — and the write is PUT-semantic, so omitted fields are nulled. A share granting the right to add objects also granted the right to overwrite every existing object in the shared register/schema.

2. @self.organisation survived too, which defeats the pin. The comment on that very line reads:

Pin the object to the sharing organisation — a federated writer can never plant an object into another organisation.

It could.

The second was found by the first test written for the first. A pin has to overwrite, or it is only a default.

Also fixed

DsarCaseController::create() — guarded by requireAuthenticated() rather than an admin setting, and stripped only _route, so a create could address an existing DSAR case.

Evidence

Three new tests, each failing against the original code and passing against the fix. The third asserts the pin and that the payload still arrives, so the guard cannot have traded one defect for another by over-stripping.

Full suite: 19037 tests, phpcs clean.

Not claimed

End-to-end exploitability. Both paths need a valid read-write share token, and I did not drive this against a live federated pair. The code path and the + semantics are demonstrated; the operational reachability is not.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/openregister @ 919b1e2

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 174/174
npm			✅	✅ 543/543
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					❌
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					❌

---

Quality workflow — 2026-09-03 05:17 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ 472abbe

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 174/174
npm			✅	✅ 543/543
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					❌

---

Quality workflow — 2026-09-03 05:25 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/openregister @ cc4f422

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		✅
test-l10n-parity		✅
format		✅
check-schema-l10n		✅
check-l10n-js		✅
composer			✅	✅ 174/174
npm			✅	✅ 543/543
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					✅
Playwright					⏭️ deferred — runs on the promotion into beta/main, not on a pull request into development
Hydra gates					✅

---

Quality workflow — 2026-09-03 05:34 UTC

Download the full PDF report from the workflow artifacts.