You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Jeff Young (Commented) (JIRA)" <ji...@apache.org> on 2011/12/05 20:46:41 UTC
[jira] [Commented] (SLING-2320) Current DOS-prevention for
infinity.json can prevent enumeration of children
[ https://issues.apache.org/jira/browse/SLING-2320?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13162978#comment-13162978 ]
Jeff Young commented on SLING-2320:
-----------------------------------
Note: the patch has SLING-XXXX in it because I thought I had to create it before creating the JIRA issue. (And then, of course, I forgot to update it before uploading.)
> Current DOS-prevention for infinity.json can prevent enumeration of children
> ----------------------------------------------------------------------------
>
> Key: SLING-2320
> URL: https://issues.apache.org/jira/browse/SLING-2320
> Project: Sling
> Issue Type: Bug
> Components: Servlets
> Affects Versions: Servlets Get 2.1.0
> Reporter: Jeff Young
> Labels: newbie, patch
> Attachments: jsonRenderer.diff
>
> Original Estimate: 1h
> Remaining Estimate: 1h
>
> A request of resource.1.json should always succeed, as it's the primary method for JSON introspection of the repository hierarchy. DOS protection should only apply to "deep" traversals; that is, anything with a depth greater than 1 (and, in particular, resource.infinity.json).
> For a fuller discussion, see: http://www.mail-archive.com/dev@sling.apache.org/msg13961.html.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira