[jira] [Reopened] (SLING-2320) Current DOS-prevention for infinity.json can prevent enumeration of children

["Justin Edelson (Reopened) (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SLING-2320?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Justin Edelson reopened SLING-2320:
-----------------------------------


As I mentioned in the mailing list thread, this behavior should be configurable. Either:
1) Enable the restoration of the old behavior with a boolean property
2) Specify a different maximum number of resources for the first level (and -1 == no limit).
                
> Current DOS-prevention for infinity.json can prevent enumeration of children
> ----------------------------------------------------------------------------
>
>                 Key: SLING-2320
>                 URL: https://issues.apache.org/jira/browse/SLING-2320
>             Project: Sling
>          Issue Type: Bug
>          Components: Servlets
>    Affects Versions: Servlets Get 2.1.0
>            Reporter: Jeff Young
>            Assignee: Felix Meschberger
>              Labels: newbie, patch
>             Fix For: Servlets Get 2.1.4
>
>         Attachments: jsonRenderer.diff
>
>   Original Estimate: 1h
>  Remaining Estimate: 1h
>
> A request of resource.1.json should always succeed, as it's the primary method for JSON introspection of the repository hierarchy.  DOS protection should only apply to "deep" traversals; that is, anything with a depth greater than 1 (and, in particular, resource.infinity.json).
> For a fuller discussion, see: http://www.mail-archive.com/dev@sling.apache.org/msg13961.html.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira