Empty name database #589

^{Originally posted by gramian October 21, 2022}
Dear Community,

Experimenting with the HTTP API, I found the following:

curl -X POST http://localhost:2480/api/v1/open// --user root:arcadedb
{ "result" : "ok"}

curl -X GET http://localhost:2480/api/v1/query//sql/SELECT%20%22hi%22 --user root:arcadedb
{"result":[{"\"hi\"":"hi"}],"user":"root","version":"22.9.1 (build d082adcc702df85f7fd6f7a707d21aed4c7d0e68/1664822987697/main)"}

So it seems there is a database with name "". This "empty name"-database can be opened and interacted with, etc. Now, I was wondering if this is a bug or a feature? I can see the advantage of such a default database to easily test the query engines etc, and as long as it is just GET calls, I think this is fine, but POST calls seem also available which could be a security issue, particularly if non-root users could do this (which I couldn't/didn't test)?

BTW: This empty-name database can even be dropped, and after restarting the server it can be opened again.

Thanks for clearing this up