You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@myfaces.apache.org by "Frederick Kämpfer (Created JIRA)" <de...@myfaces.apache.org> on 2011/11/22 12:32:40 UTC
[jira] [Created] (MYFACES-3405) includeViewParameters re-evaluates
param/model values as EL expressions
includeViewParameters re-evaluates param/model values as EL expressions
-----------------------------------------------------------------------
Key: MYFACES-3405
URL: https://issues.apache.org/jira/browse/MYFACES-3405
Project: MyFaces Core
Issue Type: Bug
Affects Versions: 2.1.3
Environment: MyFaces 2.1.3
Reporter: Frederick Kämpfer
I just wanted to make you aware of the following security issue in conjunction with the includeViewParameters navigation parameter. It seems it is also reproducible with MyFaces:
http://java.net/jira/browse/JAVASERVERFACES-2247
I'm not sure which workaround would be best in accordance with the Spec, but at least a quick fix might be worth considering to improve the security of the default behavior.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MYFACES-3405) includeViewParameters re-evaluates
param/model values as EL expressions
Posted by "Leonardo Uribe (Updated) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3405?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Leonardo Uribe updated MYFACES-3405:
------------------------------------
Status: Patch Available (was: Open)
> includeViewParameters re-evaluates param/model values as EL expressions
> -----------------------------------------------------------------------
>
> Key: MYFACES-3405
> URL: https://issues.apache.org/jira/browse/MYFACES-3405
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.3
> Environment: MyFaces 2.1.3
> Reporter: Frederick Kämpfer
> Attachments: MYFACES-3405-1.patch
>
>
> I just wanted to make you aware of the following security issue in conjunction with the includeViewParameters navigation parameter. It seems it is also reproducible with MyFaces:
> http://java.net/jira/browse/JAVASERVERFACES-2247
> I'm not sure which workaround would be best in accordance with the Spec, but at least a quick fix might be worth considering to improve the security of the default behavior.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (MYFACES-3405) includeViewParameters re-evaluates
param/model values as EL expressions
Posted by "Leonardo Uribe (Updated) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3405?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Leonardo Uribe updated MYFACES-3405:
------------------------------------
Resolution: Fixed
Fix Version/s: 2.1.5
2.0.11
Assignee: Leonardo Uribe
Status: Resolved (was: Patch Available)
Committed on 2.0.x branch and trunk. Thanks for the example.
> includeViewParameters re-evaluates param/model values as EL expressions
> -----------------------------------------------------------------------
>
> Key: MYFACES-3405
> URL: https://issues.apache.org/jira/browse/MYFACES-3405
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.3
> Environment: MyFaces 2.1.3
> Reporter: Frederick Kämpfer
> Assignee: Leonardo Uribe
> Fix For: 2.0.11, 2.1.5
>
> Attachments: MYFACES-3405-1.patch
>
>
> I just wanted to make you aware of the following security issue in conjunction with the includeViewParameters navigation parameter. It seems it is also reproducible with MyFaces:
> http://java.net/jira/browse/JAVASERVERFACES-2247
> I'm not sure which workaround would be best in accordance with the Spec, but at least a quick fix might be worth considering to improve the security of the default behavior.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MYFACES-3405) includeViewParameters
re-evaluates param/model values as EL expressions
Posted by "Leonardo Uribe (Commented) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3405?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13155471#comment-13155471 ]
Leonardo Uribe commented on MYFACES-3405:
-----------------------------------------
Attached patch that fix the issue. Just create an utility class for evaluation (NavigationUtils) and use it on the right spots where we need it. In this way, we prevent EL evaluation for params received from UIViewParameter instances.
> includeViewParameters re-evaluates param/model values as EL expressions
> -----------------------------------------------------------------------
>
> Key: MYFACES-3405
> URL: https://issues.apache.org/jira/browse/MYFACES-3405
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.3
> Environment: MyFaces 2.1.3
> Reporter: Frederick Kämpfer
> Attachments: MYFACES-3405-1.patch
>
>
> I just wanted to make you aware of the following security issue in conjunction with the includeViewParameters navigation parameter. It seems it is also reproducible with MyFaces:
> http://java.net/jira/browse/JAVASERVERFACES-2247
> I'm not sure which workaround would be best in accordance with the Spec, but at least a quick fix might be worth considering to improve the security of the default behavior.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MYFACES-3405) includeViewParameters
re-evaluates param/model values as EL expressions
Posted by "Jakob Korherr (Commented) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3405?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13155485#comment-13155485 ]
Jakob Korherr commented on MYFACES-3405:
----------------------------------------
The patch looks good, +1 on committing.
Have you tried it with http://code.google.com/a/apache-extras.org/p/jsf-includeviewparams-security-hole-example/ ?
Regards,
Jakob
> includeViewParameters re-evaluates param/model values as EL expressions
> -----------------------------------------------------------------------
>
> Key: MYFACES-3405
> URL: https://issues.apache.org/jira/browse/MYFACES-3405
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.3
> Environment: MyFaces 2.1.3
> Reporter: Frederick Kämpfer
> Attachments: MYFACES-3405-1.patch
>
>
> I just wanted to make you aware of the following security issue in conjunction with the includeViewParameters navigation parameter. It seems it is also reproducible with MyFaces:
> http://java.net/jira/browse/JAVASERVERFACES-2247
> I'm not sure which workaround would be best in accordance with the Spec, but at least a quick fix might be worth considering to improve the security of the default behavior.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (MYFACES-3405) includeViewParameters
re-evaluates param/model values as EL expressions
Posted by "Leonardo Uribe (Commented) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/MYFACES-3405?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13155517#comment-13155517 ]
Leonardo Uribe commented on MYFACES-3405:
-----------------------------------------
I tried it and the patch is ok.
> includeViewParameters re-evaluates param/model values as EL expressions
> -----------------------------------------------------------------------
>
> Key: MYFACES-3405
> URL: https://issues.apache.org/jira/browse/MYFACES-3405
> Project: MyFaces Core
> Issue Type: Bug
> Affects Versions: 2.1.3
> Environment: MyFaces 2.1.3
> Reporter: Frederick Kämpfer
> Attachments: MYFACES-3405-1.patch
>
>
> I just wanted to make you aware of the following security issue in conjunction with the includeViewParameters navigation parameter. It seems it is also reproducible with MyFaces:
> http://java.net/jira/browse/JAVASERVERFACES-2247
> I'm not sure which workaround would be best in accordance with the Spec, but at least a quick fix might be worth considering to improve the security of the default behavior.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira