REST etag security

The REST code generates an etag as an md5 hash of a representation of item 
properties.

That includes properties to which the user does not have access.  
Depending on the schema, that means it could be used as an oracle to test 
guesses for values of such properties by generating hashes with guessed 
values for those properties inserted and seeing if those match the 
provided etag.

This could be addressed by using HMAC with a per-instance random secret 
key, instead of a simple hash function, or by storing a random etag in the 
database for each item (generated automatically like the 'activity' 
property) so it's not related to item properties at all, just changes to a 
new random value whenever any other change is made.

-- 
Joseph S. Myers
[email protected]