You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@struts.apache.org by Tatekura Hisato <hi...@gmail.com> on 2007/10/16 16:46:18 UTC
A session value is overwrited by demanding a browser.
Hello.
I found the following.
http://example.com/SomeAction.action?session.somekey=someValue
This request rewrites the session.
Does this become a security hole?
Thanks.
hisato.killing@gmail.com
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: A session value is overwrited by demanding a browser.
Posted by Dave Newton <ne...@yahoo.com>.
I guess I assumed people had thought of this during
the OGNL submission fiesta :(
Would it be quick and sufficient to include a
parameter filter interceptor to disallow ActionSupport
- implemented interface methods?
d.
--- Tom Schneider <sc...@gmail.com> wrote:
> No because OGNL can access the private Session
> variable directly. (I
> noticed this behavior when I was fixing a race
> condition) It first
> tries to call the get<property>(), if that fails,
> then it will turn on
> reflection accessibility and access the variable
> directly.
>
> On 10/17/07, Jim Cushing <ji...@mac.com> wrote:
> > I haven't tested this, but is the problem solved
> by making your
> > getSession() method protected, instead of public?
> The SessionAware
> > interface only requires a public setSession()
> method. If you haven't
> > defined a getSession() method, or if it's already
> protected, then I
> > suggest you file a JIRA ticket
> (http://issues.apache.org/struts/),
> > perhaps with some sample code.
> >
> > On Oct 17, 2007, at 9:12 AM, Hisato Killing wrote:
> >
> > > Hello.
> > >
> > > I'm sorry. Information that I had sent seems to
> have been
> > > insufficient.
> > >
> > > 1.This problem is caused in struts 2.0.9 and
> others perhaps.
> > >
> > > In that case, it is assumed that it is as
> follows.
> > > i. SomeAction is implements SessionAware.
> > > ii. And It is defined in struts-default.
> > > iii. devMode is true or false.
> > >
> > > ["someValue"] of the name of "someKey" enters in
> SessionMap when the
> > > request shown in that URL is processed.
> > > It is meant that ["someValue"] is an array
> including "someValue".
> > > This causes ClassCastException in case of
> almost.
> > >
> > > hisato.killing@gmail.com
> > > It is thought that this only has to be my
> mistake ,setting etc.
> > >
> > > Thanks
> > >
> > >
>
---------------------------------------------------------------------
> > > To unsubscribe, e-mail:
> dev-unsubscribe@struts.apache.org
> > > For additional commands, e-mail:
> dev-help@struts.apache.org
> > >
> >
> >
> >
>
---------------------------------------------------------------------
> > To unsubscribe, e-mail:
> dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail:
> dev-help@struts.apache.org
> >
> >
>
>
---------------------------------------------------------------------
> To unsubscribe, e-mail:
> dev-unsubscribe@struts.apache.org
> For additional commands, e-mail:
> dev-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: A session value is overwrited by demanding a browser.
Posted by Don Brown <mr...@twdata.org>.
For those not following the ticket, I've written unit tests that
verify this is not an issue. Private variables and protected accessor
methods are not accessed by the ParametersInterceptor, which is the
piece that translates request parameters to method calls.
As always, this is a good time to reiterate that you do need to be
careful what data you expose via public accessor methods on your
Actions.
Don
On 10/18/07, Hisato Killing <hi...@gmail.com> wrote:
> Hello.
>
> I posted this issue to JIRA.
>
> Thank you for your advice, Phil and Jim.
>
> I atached a sample.
> A action named SessionUser has no public getSession(), but this
> problem is caused.
>
> I think that it is necessary to fix this.
>
>
> >>> it seems that Hisato Killing
> >>> (or Tatekura Hisato, who knows? :-) )
>
> I had forgotten introducing oneself.
> My name is Hisato Tatekura. Killing is my handle name it means "samurai slash".
> I live in Tokyo, Japan. And I speek Japanese and Java, so I'm not good
> at English.
>
> Thanks.
>
> --
> Hisato "killing" Tatekura
> hisato.killing@gmail.com
> http://www.gigafield.org/ (Japanese language)
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: A session value is overwrited by demanding a browser.
Posted by Hisato Killing <hi...@gmail.com>.
Hello.
I posted this issue to JIRA.
Thank you for your advice, Phil and Jim.
I atached a sample.
A action named SessionUser has no public getSession(), but this
problem is caused.
I think that it is necessary to fix this.
>>> it seems that Hisato Killing
>>> (or Tatekura Hisato, who knows? :-) )
I had forgotten introducing oneself.
My name is Hisato Tatekura. Killing is my handle name it means "samurai slash".
I live in Tokyo, Japan. And I speek Japanese and Java, so I'm not good
at English.
Thanks.
--
Hisato "killing" Tatekura
hisato.killing@gmail.com
http://www.gigafield.org/ (Japanese language)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: A session value is overwrited by demanding a browser.
Posted by Jim Cushing <ji...@mac.com>.
Is that a desirable behavior for OGNL (accessing private fields)? It
seems this could open up a lot of issues, beyond just the session. If
I don't want something readable or settable from a form, making it
protected or private makes sense to me. Now if only it actually
worked that way!
Perhaps OGNL should allow inspection/setting of protected/private
fields off?
On Oct 17, 2007, at 10:29 AM, Tom Schneider wrote:
> No because OGNL can access the private Session variable directly. (I
> noticed this behavior when I was fixing a race condition) It first
> tries to call the get<property>(), if that fails, then it will turn on
> reflection accessibility and access the variable directly.
>
> On 10/17/07, Jim Cushing <ji...@mac.com> wrote:
>> I haven't tested this, but is the problem solved by making your
>> getSession() method protected, instead of public? The SessionAware
>> interface only requires a public setSession() method. If you haven't
>> defined a getSession() method, or if it's already protected, then I
>> suggest you file a JIRA ticket (http://issues.apache.org/struts/),
>> perhaps with some sample code.
>>
>> On Oct 17, 2007, at 9:12 AM, Hisato Killing wrote:
>>
>>> Hello.
>>>
>>> I'm sorry. Information that I had sent seems to have been
>>> insufficient.
>>>
>>> 1.This problem is caused in struts 2.0.9 and others perhaps.
>>>
>>> In that case, it is assumed that it is as follows.
>>> i. SomeAction is implements SessionAware.
>>> ii. And It is defined in struts-default.
>>> iii. devMode is true or false.
>>>
>>> ["someValue"] of the name of "someKey" enters in SessionMap when the
>>> request shown in that URL is processed.
>>> It is meant that ["someValue"] is an array including "someValue".
>>> This causes ClassCastException in case of almost.
>>>
>>> hisato.killing@gmail.com
>>> It is thought that this only has to be my mistake ,setting etc.
>>>
>>> Thanks
>>>
>>> --------------------------------------------------------------------
>>> -
>>> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
>>> For additional commands, e-mail: dev-help@struts.apache.org
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
>> For additional commands, e-mail: dev-help@struts.apache.org
>>
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: A session value is overwrited by demanding a browser.
Posted by Tom Schneider <sc...@gmail.com>.
No because OGNL can access the private Session variable directly. (I
noticed this behavior when I was fixing a race condition) It first
tries to call the get<property>(), if that fails, then it will turn on
reflection accessibility and access the variable directly.
On 10/17/07, Jim Cushing <ji...@mac.com> wrote:
> I haven't tested this, but is the problem solved by making your
> getSession() method protected, instead of public? The SessionAware
> interface only requires a public setSession() method. If you haven't
> defined a getSession() method, or if it's already protected, then I
> suggest you file a JIRA ticket (http://issues.apache.org/struts/),
> perhaps with some sample code.
>
> On Oct 17, 2007, at 9:12 AM, Hisato Killing wrote:
>
> > Hello.
> >
> > I'm sorry. Information that I had sent seems to have been
> > insufficient.
> >
> > 1.This problem is caused in struts 2.0.9 and others perhaps.
> >
> > In that case, it is assumed that it is as follows.
> > i. SomeAction is implements SessionAware.
> > ii. And It is defined in struts-default.
> > iii. devMode is true or false.
> >
> > ["someValue"] of the name of "someKey" enters in SessionMap when the
> > request shown in that URL is processed.
> > It is meant that ["someValue"] is an array including "someValue".
> > This causes ClassCastException in case of almost.
> >
> > hisato.killing@gmail.com
> > It is thought that this only has to be my mistake ,setting etc.
> >
> > Thanks
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail: dev-help@struts.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: A session value is overwrited by demanding a browser.
Posted by Jim Cushing <ji...@mac.com>.
I haven't tested this, but is the problem solved by making your
getSession() method protected, instead of public? The SessionAware
interface only requires a public setSession() method. If you haven't
defined a getSession() method, or if it's already protected, then I
suggest you file a JIRA ticket (http://issues.apache.org/struts/),
perhaps with some sample code.
On Oct 17, 2007, at 9:12 AM, Hisato Killing wrote:
> Hello.
>
> I'm sorry. Information that I had sent seems to have been
> insufficient.
>
> 1.This problem is caused in struts 2.0.9 and others perhaps.
>
> In that case, it is assumed that it is as follows.
> i. SomeAction is implements SessionAware.
> ii. And It is defined in struts-default.
> iii. devMode is true or false.
>
> ["someValue"] of the name of "someKey" enters in SessionMap when the
> request shown in that URL is processed.
> It is meant that ["someValue"] is an array including "someValue".
> This causes ClassCastException in case of almost.
>
> hisato.killing@gmail.com
> It is thought that this only has to be my mistake ,setting etc.
>
> Thanks
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: A session value is overwrited by demanding a browser.
Posted by Philip Luppens <ph...@gmail.com>.
On 10/17/07, Hisato Killing <hi...@gmail.com> wrote:
> Hello.
>
> I'm sorry. Information that I had sent seems to have been insufficient.
>
> 1.This problem is caused in struts 2.0.9 and others perhaps.
>
> In that case, it is assumed that it is as follows.
> i. SomeAction is implements SessionAware.
> ii. And It is defined in struts-default.
> iii. devMode is true or false.
>
> ["someValue"] of the name of "someKey" enters in SessionMap when the
> request shown in that URL is processed.
> It is meant that ["someValue"] is an array including "someValue".
> This causes ClassCastException in case of almost.
>
> hisato.killing@gmail.com
> It is thought that this only has to be my mistake ,setting etc.
>
> Thanks
Hello Mr. Killing,
Thank for reporting the issue - I haven't been able to verify it, but
if this is indeed true (and by the looks of it, I would say it is -
OGNL is a bit too powerful), then it is indeed a pretty serious
security problem.
A first solution that comes to mind would be to block 'session.'
parameters van an Action implements SessionAware, but it would
probably be insufficient, as other expressions might be found to
bypass this simplistic fix. We'll probably have to delve deeper into
OGNL to make sure it cannot write values in the session map.
Would you be so kind to report this in the Struts 2 bug tracker [1] ?
That would make sure it gets a proper look.
Thanks,
Phil
[1] https://issues.apache.org/struts/browse/WW
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>
--
Software Architect - Hydrodesk
"Always code as if the guy who ends up maintaining your code will be a
violent psychopath who knows where you live." - John F. Woods
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: A session value is overwrited by demanding a browser.
Posted by Hisato Killing <hi...@gmail.com>.
Hello.
I'm sorry. Information that I had sent seems to have been insufficient.
1.This problem is caused in struts 2.0.9 and others perhaps.
In that case, it is assumed that it is as follows.
i. SomeAction is implements SessionAware.
ii. And It is defined in struts-default.
iii. devMode is true or false.
["someValue"] of the name of "someKey" enters in SessionMap when the
request shown in that URL is processed.
It is meant that ["someValue"] is an array including "someValue".
This causes ClassCastException in case of almost.
hisato.killing@gmail.com
It is thought that this only has to be my mistake ,setting etc.
Thanks
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org