You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@struts.apache.org by Da...@Newfield.org on 2007/07/17 07:18:20 UTC
Re: Preventing OGNL evaluations of user input (was Re: Struts 2
performance)
<16...@mail.gmail.com>
<aa...@mail.gmail.com>
<93...@mail.gmail.com>
From: Dale Newfield <Da...@Newfield.org>
Date: Tue, 17 Jul 2007 1:17:55 -0500
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7bit
"Aram Mkhitaryan" <aram.mkhitaryan@googlemail.com
>I have to repeat my suggestion about the new "eval" method in ognl
>expressions which will force the evaluation
But of course this would still be a security hole if usable by
client-provided strings, and would still need to be disallowed there. How
is surrounding a string with "%{" and "}" not the "eval" you request?
-Dale Newfield
Dale@Newfield.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
RE: Preventing OGNL evaluations of user input (was Re: Struts 2
performance)
Posted by Rainer Hermanns <he...@aixcept.de>.
Hi,
The security fix release for XWork2 is currently in progress and should be
available within the next 24hours. As soon as XWork2 is released, we can
start with the S2 release process. Cause this is really a bug in XWork, we
need to wait for that release.
In the meantime you might want to continue with a SNAPSHOT build of XWork2
available here:
http://maven.opensymphony.com/opensymphony/jars/xwork-2.0.4-SNAPSHOT.jar
This XWork2 release already contains the required patches and should resolve
the issue.
tia,
Rainer
> Hi Ted,
>
> I would have thought with this being such a potentially bad bug that you
> would release a new version?
>
> That means checking out everything. It gives a warning that it is a lot
> of data. Do you know how large it is approximately.
>
> Or could you possibly do a build for us and put a binary somewhere for
> us to access please.
>
> Thanks
>
> Dave.
>
> -----Original Message-----
> From: ted.husted@gmail.com [mailto:ted.husted@gmail.com] On Behalf Of
> Ted Husted
> Sent: 18 July 2007 12:24
> To: Struts Developers List
> Subject: Re: Preventing OGNL evaluations of user input (was Re: Struts 2
> performance)
>
> SVN.
>
> * http://struts.apache.org/dev/builds.html
>
> Unfortunately, the nightly builds aren't working right now, so to try
> the changes the only alternative right now is to build the HEAD from
> source.
>
> -Ted.
>
> On 7/18/07, Aram Mkhitaryan <ar...@googlemail.com> wrote:
>> In the give link it is written that to get changes I have to get the
>> latest version.
>>
>> Where can I get that version from? (fro SVN? or it is in 2.0.8?)
>>
>> Thanks,
>> Aram
>> ________________________________
>> Aram Mkhitaryan
>>
>> 52, 25 Lvovyan, Yerevan 375000, Armenia
>>
>> Mobile: +374 91 518456
>> E-mail: aram.mkhitaryan@googlemail.com
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org For additional
> commands, e-mail: dev-help@struts.apache.org
>
>
> - ------
> ML {UFI}
>
> ______________________________________________________________________
> Ufi Limited
> Registered in England No. 3980770
> Registered Office: Dearing House, 1 Young Street, Sheffield, S1 4UP
>
> learndirect Solutions Ltd
> Registered in England No. 5081669
> Registered Office: Dearing House, 1 Young Street, Sheffield, S1 4UP
>
> UFI Charitable Trust
> Registered in England No. 3658378
> Registered Charity No. 1081028
> Registered Office: Dearing House, 1 Young Street, Sheffield, S1 4UP
>
> This email has been scanned by the MessageLabs Email Security System.
>
> ______________________________________________________________________
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>
--
Rainer Hermanns
aixcept
Neupforte 16
52062 Aachen - Germany
w: http://aixcept.de/
t: +49-241-4012247
m: +49-170-3432912
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
RE: Preventing OGNL evaluations of user input (was Re: Struts 2 performance)
Posted by David Harland <dh...@ufi.com>.
Hi Ted,
I would have thought with this being such a potentially bad bug that you
would release a new version?
That means checking out everything. It gives a warning that it is a lot
of data. Do you know how large it is approximately.
Or could you possibly do a build for us and put a binary somewhere for
us to access please.
Thanks
Dave.
-----Original Message-----
From: ted.husted@gmail.com [mailto:ted.husted@gmail.com] On Behalf Of
Ted Husted
Sent: 18 July 2007 12:24
To: Struts Developers List
Subject: Re: Preventing OGNL evaluations of user input (was Re: Struts 2
performance)
SVN.
* http://struts.apache.org/dev/builds.html
Unfortunately, the nightly builds aren't working right now, so to try
the changes the only alternative right now is to build the HEAD from
source.
-Ted.
On 7/18/07, Aram Mkhitaryan <ar...@googlemail.com> wrote:
> In the give link it is written that to get changes I have to get the
> latest version.
>
> Where can I get that version from? (fro SVN? or it is in 2.0.8?)
>
> Thanks,
> Aram
> ________________________________
> Aram Mkhitaryan
>
> 52, 25 Lvovyan, Yerevan 375000, Armenia
>
> Mobile: +374 91 518456
> E-mail: aram.mkhitaryan@googlemail.com
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org For additional
commands, e-mail: dev-help@struts.apache.org
- ------
ML {UFI}
______________________________________________________________________
Ufi Limited
Registered in England No. 3980770
Registered Office: Dearing House, 1 Young Street, Sheffield, S1 4UP
learndirect Solutions Ltd
Registered in England No. 5081669
Registered Office: Dearing House, 1 Young Street, Sheffield, S1 4UP
UFI Charitable Trust
Registered in England No. 3658378
Registered Charity No. 1081028
Registered Office: Dearing House, 1 Young Street, Sheffield, S1 4UP
This email has been scanned by the MessageLabs Email Security System.
______________________________________________________________________
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: Preventing OGNL evaluations of user input (was Re: Struts 2 performance)
Posted by Ted Husted <hu...@apache.org>.
SVN.
* http://struts.apache.org/dev/builds.html
Unfortunately, the nightly builds aren't working right now, so to try
the changes the only alternative right now is to build the HEAD from
source.
-Ted.
On 7/18/07, Aram Mkhitaryan <ar...@googlemail.com> wrote:
> In the give link it is written that to get changes I have to get the latest
> version.
>
> Where can I get that version from? (fro SVN? or it is in 2.0.8?)
>
> Thanks,
> Aram
> ________________________________
> Aram Mkhitaryan
>
> 52, 25 Lvovyan, Yerevan 375000, Armenia
>
> Mobile: +374 91 518456
> E-mail: aram.mkhitaryan@googlemail.com
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Re: Preventing OGNL evaluations of user input (was Re: Struts 2 performance)
Posted by Aram Mkhitaryan <ar...@googlemail.com>.
In the give link it is written that to get changes I have to get the latest
version.
Where can I get that version from? (fro SVN? or it is in 2.0.8?)
Thanks,
Aram
________________________________
Aram Mkhitaryan
52, 25 Lvovyan, Yerevan 375000, Armenia
Mobile: +374 91 518456
E-mail: aram.mkhitaryan@googlemail.com
Re: Preventing OGNL evaluations of user input (was Re: Struts 2 performance)
Posted by Antonio Petrelli <an...@gmail.com>.
2007/7/17, Aram Mkhitaryan <ar...@googlemail.com>:
>
> I mean if I have myOgnlExpression(%{'property'+2}) in value stack,
>
> according to the latest changes %{myOgnlExpression} will print
> "%{'property'+2}"
> but what if that expression is not client side defined, but site
> administrator/developer defined and id should be executed???
> but if we have %{eval(myOgnlExpression)} it may print for example "welcome
> to ..." (the value of property2)
It's different: the evaluation will be executed server-side in a controlled
environment. In other words, you have to follow these steps:
1. accept the expression from the client;
2. store the expression somewhere (such as a DB);
3. when it is necessary, it is evaluated.
Currently the security hole does:
1. accept the expression from the client;
2. evaluate and store the result in the server.
This is a bug.
Antonio
Re: Preventing OGNL evaluations of user input (was Re: Struts 2 performance)
Posted by Aram Mkhitaryan <ar...@googlemail.com>.
I mean if I have myOgnlExpression(%{'property'+2}) in value stack,
according to the latest changes %{myOgnlExpression} will print
"%{'property'+2}"
but what if that expression is not client side defined, but site
administrator/developer defined and id should be executed???
but if we have %{eval(myOgnlExpression)} it may print for example "welcome
to ..." (the value of property2)
Best,
Aram
________________________________
Aram Mkhitaryan
52, 25 Lvovyan, Yerevan 375000, Armenia
Mobile: +374 91 518456
E-mail: aram.mkhitaryan@googlemail.com