[jira] Commented: (GERONIMO-4266) Upgrade to DWR 2.0.5 for XSS security fix

["Donald Woods (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/GERONIMO-4266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12625839#action_12625839 ] 

Donald Woods commented on GERONIMO-4266:
----------------------------------------

r689182 in branches/2.1 (2.1.3-SNAPSHOT)
r689188 in trunk (2.2-SNAPSHOT)

> Upgrade to DWR 2.0.5 for XSS security fix
> -----------------------------------------
>
>                 Key: GERONIMO-4266
>                 URL: https://issues.apache.org/jira/browse/GERONIMO-4266
>             Project: Geronimo
>          Issue Type: Bug
>      Security Level: public(Regular issues) 
>          Components: dependencies
>    Affects Versions: 2.0, 2.0.1, 2.0.2, 2.0.3, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2
>            Reporter: Donald Woods
>            Assignee: Donald Woods
>             Fix For: 2.0.3, 2.1.3, 2.2
>
>
> Need to upgrade to DWR 2.0.5 for the following fix -
> ------------------------------------------------------------------------
> r2077 | joe | 2008-06-22 09:28:22 -0400 (Sun, 22 Jun 2008) | 7 lines
> Fix for XSS issue in ExceptionHandler:
> PartialResponse.fromOrdinal() throws a NumberFormatException trying to
> parse the 'partialResponse' parameter.  This exception is never caught,
> prompting UrlProcessor to invoke DWR's default ExceptionHandler class,
> which calls out.println(cause.getMessage()), thereby causing the XSS.
> ------------------------------------------------------------------------

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.