[struts-site] branch tip-with-error-page created (now 4443c9f)

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a change to branch tip-with-error-page
in repository https://gitbox.apache.org/repos/asf/struts-site.git.


      at 4443c9f  Adds a tip to use custom error page or disable DMI

This branch includes the following new commits:

     new 4443c9f  Adds a tip to use custom error page or disable DMI

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

[struts-site] 01/01: Adds a tip to use custom error page or disable DMI

[lu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

lukaszlenart pushed a commit to branch tip-with-error-page
in repository https://gitbox.apache.org/repos/asf/struts-site.git

commit 4443c9f338720f7027028cdc7d222af612058c0c
Author: Lukasz Lenart <lu...@apache.org>
AuthorDate: Sun Nov 10 13:21:57 2019 +0100

    Adds a tip to use custom error page or disable DMI
---
 source/security/index.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/source/security/index.md b/source/security/index.md
index 44f73f7..6046946 100644
--- a/source/security/index.md
+++ b/source/security/index.md
@@ -150,6 +150,30 @@ Never use a raw `${}` EL expression on incoming values as this can lead to injec
 
 The safest option is to use Struts Tags instead.
 
+### Define custom error pages
+
+As mentioned in [S2-006](https://cwiki.apache.org/confluence/display/WW/S2-006) it's a good practicse to define your own 
+error pages. This avoids exposing users to XSS attacks as Struts does not escape action's names in automatically 
+generated error pages.
+
+You can eaither disable [DMI](../core-developers/action-configuration#dynamic-method-invocation)
+
+```xml
+<constant name="struts.enable.DynamicMethodInvocation" value="false" />
+``` 
+
+or define an error page
+
+```xml
+<global-results>
+  <result name="error">/error_page.jsp</result>
+</global-results>
+ 
+<global-exception-mappings>
+  <exception-mapping exception="java.lang.Exception" result="error"/>
+</global-exception-mappings>
+```
+
 ## Internal security mechanism
 
 The Apache Struts 2 contains internal security manager which blocks access to particular classes and Java packages -