You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Bill Barker <wb...@wilshire.com> on 2002/09/26 06:53:34 UTC
[OT] Re: [SECURITY] Apache Tomcat 4.x JSP source disclosure vulnerability
I'm agreeing with Costin. Please move this discussion to
velocity-dev@jakarta.apache.org. It is off-topic here.
----- Original Message -----
From: "Bojan Smojver" <bo...@rexursive.com>
To: "Tomcat Developers List" <to...@jakarta.apache.org>
Sent: Wednesday, September 25, 2002 7:33 PM
Subject: Re: [SECURITY] Apache Tomcat 4.x JSP source disclosure
vulnerability
> Not if:
>
> runtime.interpolate.string.literals = false
>
> Bojan
>
> Quoting Tim Funk <fu...@joedog.org>:
>
> > That's what code reviews are for and in absence of that - firing your
> > developers.
> >
> > Wouldn't I also get an out of memory with this in Velocity?
> >
> > #set($oom = "0000000000000000000000000000000000000000000000000000" )
> > #foreach( $i in [-2147483648..2147483648] )
> > #set($oom = "$oom$oom$oom$oom$oom$oom$oom$oom$oom$oom$oom$oom$oom$oom" )
> > #end
> >
> > Bad code can kill ANY system for the determined(disgruntled) developer.
> >
> >
> > Bojan Smojver wrote:
> > > All right then, let's talk about JSP's. If I host my clients' JSP's on
my
> > server
> > > and a web designer puts this in (BTW, he wasn't forced, he simply
decided
> > he
> > > wanted to do it):
> > >
> > > -----------------------------------------------
> > > Hashtable strings = new Hashtable();
> > > int i=0;
> > > while (true)
> > > {
> > > strings.put ("dead"+i, new StringBuffer(999999));
> > > }
> > > -----------------------------------------------
> > >
> >
> >
> > --
> > To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
> > For additional commands, e-mail:
<ma...@jakarta.apache.org>
> >
> >
>
>
>
>
> -------------------------------------------------
> This mail sent through IMP: http://horde.org/imp/
>
> --
> To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
> For additional commands, e-mail:
<ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [OT] Re: [SECURITY] Apache Tomcat 4.x JSP source disclosure
vulnerability
Posted by co...@covalent.net.
On Fri, 27 Sep 2002, Geir Magnusson Jr. wrote:
> On 9/26/02 5:38 PM, "Bojan Smojver" <bo...@rexursive.com> wrote:
>
> [SNIP]
>
> > with them - quite the contrary. If you know what you're doing, you can
> > write great web applications in assembler, if you don't mind vomiting a
> > lot ;-)
>
> I actually like assembler. Keeps you focused :)
I actually like assembler too. It prevents you from writing bloatware,
and makes you understand a lot of stuff. Too bad so many people are
jumping directly to MVC and OO.
Probably not the best tool for web applications - that would be Perl.
BTW, have you looked at the velocity ant properties ? ( in
ant/proposal/embed ). I would like to contribute them
back to velocity ( and same for jxpath ), if it's ok with you.
( it's the stuff that enables velocity to be used in ant
properties - like ${vm:EXPRESSION} )
Costin
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [OT] Re: [SECURITY] Apache Tomcat 4.x JSP source disclosure
vulnerability
Posted by Costin Manlache <cm...@yahoo.com>.
Ops, didn't noticed the Cc.
Sorry for the noise on the list ( I hope it gets moderated :-)
Costin
On Fri, 27 Sep 2002, Geir Magnusson Jr. wrote:
> On 9/26/02 5:38 PM, "Bojan Smojver" <bo...@rexursive.com> wrote:
>
> [SNIP]
>
> > with them - quite the contrary. If you know what you're doing, you can
> > write great web applications in assembler, if you don't mind vomiting a
> > lot ;-)
>
> I actually like assembler. Keeps you focused :)
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [OT] Re: [SECURITY] Apache Tomcat 4.x JSP source disclosure
vulnerability
Posted by "Geir Magnusson Jr." <ge...@optonline.net>.
On 9/26/02 5:38 PM, "Bojan Smojver" <bo...@rexursive.com> wrote:
[SNIP]
> with them - quite the contrary. If you know what you're doing, you can
> write great web applications in assembler, if you don't mind vomiting a
> lot ;-)
I actually like assembler. Keeps you focused :)
--
Geir Magnusson Jr.
Research & Development, Adeptra Inc.
geirm@adeptra.com
+1-203-247-1713
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [OT] Re: [SECURITY] Apache Tomcat 4.x JSP source disclosure
vulnerability
Posted by Bojan Smojver <bo...@rexursive.com>.
I have promised not to use Tomcat-Dev for this, so I'm answering
privately and I'm sending a CC to Velocity-User list, where it belongs.
Nobody is treating users as stupid. Where are you getting the ideas
about me treating anyone as stupid from? I know it's hard for you to
understand because you're a brilliant programmer, but there a people out
there that can do great things with the look of the site, but
programming is not their thing - they are not stupid because of that.
And those people are web designers. IMHO, they play a very important
role in shaping a web application. If it doesn't look good, clients
won't like it.
However, they cannot be expected to understand a programming language of
Java's complexity. That's the job for the programmers.
Velocity is not taking away any power from anyone. It is just placing it
in the correct place. In the controller and model, where it should be.
I, for one, am sometimes both the web designer (and pretty poor at it
too) of some of my clients sites and the programmer. None of the power
of Java is out of my reach. As I said, it's sitting in the controller
and the model.
I don't feel I have to convert anyone to anything. But, when people ask
direct questions, I give them direct answers. And that is - JSP are
simply a bad idea. This doesn't mean you can't write great applications
with them - quite the contrary. If you know what you're doing, you can
write great web applications in assembler, if you don't mind vomiting a
lot ;-)
Bojan
On Thu, 2002-09-26 at 16:36, Costin Manolache wrote:
> Bojan Smojver wrote:
>
> > Quoting Bill Barker <wb...@wilshire.com>:
> >
> >> I'm agreeing with Costin. Please move this discussion to
> >> velocity-dev@jakarta.apache.org. It is off-topic here.
> >
> > Promise not to write a single byte on this topic on Tomcat-Dev list after
> > this e-mail.
>
> Please don't missunderstand this - I have nothing against velocity, it
> is a nice tool ( I like the introspection/bean EL - I hope the jsp el
> will be close and I'm following the developments in commons ).
> There are many cases where its simplicity is a benefit, and
> for standalone use jsp can't be used.
>
> The problem is - this list is for servlet and jsp development.
>
> And I personally don't like the idea of treating the users
> ( web developers or not ) as stupid that shouln't have powerfull
> tools because they may do bad things.
>
> If you feel a need to convert people to velocity - I sugest you
> subscribe to Perl and PHP mailing lists ( and maybe ASP ? ). Maybe
> they'll apreciate this kind of arguments :-)
>
>
> Costin
>
>
> >
> > Bojan
> >
> > -------------------------------------------------
> > This mail sent through IMP: http://horde.org/imp/
>
> --
> Costin
>
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [OT] Re: [SECURITY] Apache Tomcat 4.x JSP source disclosure vulnerability
Posted by Costin Manolache <cm...@yahoo.com>.
Bojan Smojver wrote:
> Quoting Bill Barker <wb...@wilshire.com>:
>
>> I'm agreeing with Costin. Please move this discussion to
>> velocity-dev@jakarta.apache.org. It is off-topic here.
>
> Promise not to write a single byte on this topic on Tomcat-Dev list after
> this e-mail.
Please don't missunderstand this - I have nothing against velocity, it
is a nice tool ( I like the introspection/bean EL - I hope the jsp el
will be close and I'm following the developments in commons ).
There are many cases where its simplicity is a benefit, and
for standalone use jsp can't be used.
The problem is - this list is for servlet and jsp development.
And I personally don't like the idea of treating the users
( web developers or not ) as stupid that shouln't have powerfull
tools because they may do bad things.
If you feel a need to convert people to velocity - I sugest you
subscribe to Perl and PHP mailing lists ( and maybe ASP ? ). Maybe
they'll apreciate this kind of arguments :-)
Costin
>
> Bojan
>
> -------------------------------------------------
> This mail sent through IMP: http://horde.org/imp/
--
Costin
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [OT] Re: [SECURITY] Apache Tomcat 4.x JSP source disclosure vulnerability
Posted by Bojan Smojver <bo...@rexursive.com>.
Quoting Bill Barker <wb...@wilshire.com>:
> I'm agreeing with Costin. Please move this discussion to
> velocity-dev@jakarta.apache.org. It is off-topic here.
Promise not to write a single byte on this topic on Tomcat-Dev list after this
e-mail.
Bojan
-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>