You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by "Robert S. Sfeir" <ro...@codepuccino.com> on 2003/11/14 15:15:01 UTC
DispatchAction and Security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
Been mucking around with why I'd want to use DispatchActions, and I
understand that part, it's advantages and disadvantages, and I've read
the many threads explaining all that. My concern is on how the various
methods in the actions are called, and how they pertain to security.
For example. Say you have a parameter="method" defined, as per the
example, and you pass method="addFoo" in the URL or even as a hidden
field. Struts will go and look through your action, see that addFoo
exists and do the processing. All is fine so far. However what if
someone decides to just type in the URL method="getServlet", and
getServlet() is a public method in Action, which DispatchAction extends,
or decides to type execute (which is not as much of a concern), will
using DispatchAction honor the call to getServlet or any other public
method in DispatchAction or Action classes?
Is there an easy way, besides extending the RequestProcessor (which is
not hard of course), to add a value to the parameter passed to the
DispatchAction? What I mean is that if I specify method="addFoo", I
want to add a string to my parameter value (the one specified for
DispatchAction) so before my action is processed and tries to resolve
addFoo(), I can add param_ so that it will look for param_addFoo method.
~ If I can do that, then anyone trying to make a call to execute,
getServlet or anything like that will cause the process to look for
param_execute() or param_getServlet(), both of which don't exist of
course, hence locking down the app some more.
Perhaps this shouldn't even be a concern?
Thanks for any input you can provide.
R
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQE/tONl+cV9vuB27SARArA+AJ9XfLVJhva7pFqptBjhFzdZEI87mACgijpx
5oIZW5PPWb9ufNeoFzMLcYQ=
=Yis4
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
Re: DispatchAction and Security
Posted by "Robert S. Sfeir" <ro...@codepuccino.com>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
How is that any different? LookupDispatchAction, if I understand it
correctly, allows you to dynamically specify the method name, instead of
adding a parameter in specifying your action info in struts-config.xml.
~ You can still pass that information in the URL nothing stops you from
doing that. Even in this case I would still need to prepend a string to
the parameter value.
R
Vara Prasad Reddy wrote:
| How about using LookupDispatch Action in struts 1.1 ?
|
| -----Original Message-----
| From: Robert S. Sfeir [mailto:robert@codepuccino.com]
| Sent: Friday, November 14, 2003 7:45 PM
| To: Struts Users Mailing List
| Subject: DispatchAction and Security
|
|
| Hi,
|
| Been mucking around with why I'd want to use DispatchActions, and I
| understand that part, it's advantages and disadvantages, and I've read
| the many threads explaining all that. My concern is on how the various
| methods in the actions are called, and how they pertain to security.
|
| For example. Say you have a parameter="method" defined, as per the
| example, and you pass method="addFoo" in the URL or even as a hidden
| field. Struts will go and look through your action, see that addFoo
| exists and do the processing. All is fine so far. However what if
| someone decides to just type in the URL method="getServlet", and
| getServlet() is a public method in Action, which DispatchAction extends,
| or decides to type execute (which is not as much of a concern), will
| using DispatchAction honor the call to getServlet or any other public
| method in DispatchAction or Action classes?
|
| Is there an easy way, besides extending the RequestProcessor (which is
| not hard of course), to add a value to the parameter passed to the
| DispatchAction? What I mean is that if I specify method="addFoo", I
| want to add a string to my parameter value (the one specified for
| DispatchAction) so before my action is processed and tries to resolve
| addFoo(), I can add param_ so that it will look for param_addFoo method.
| ~ If I can do that, then anyone trying to make a call to execute,
| getServlet or anything like that will cause the process to look for
| param_execute() or param_getServlet(), both of which don't exist of
| course, hence locking down the app some more.
|
| Perhaps this shouldn't even be a concern?
|
| Thanks for any input you can provide.
|
| R
|
- ---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
- ---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQE/tOjq+cV9vuB27SARAp2cAJ9TslnT1P1AZ+pTHExTY1Mk0+lr5QCg6xT4
2Pw2c5t3JkL2ybnZF2INn/4=
=0Kam
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
RE: DispatchAction and Security
Posted by Vara Prasad Reddy <va...@applabs.net>.
How about using LookupDispatch Action in struts 1.1 ?
-----Original Message-----
From: Robert S. Sfeir [mailto:robert@codepuccino.com]
Sent: Friday, November 14, 2003 7:45 PM
To: Struts Users Mailing List
Subject: DispatchAction and Security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
Been mucking around with why I'd want to use DispatchActions, and I
understand that part, it's advantages and disadvantages, and I've read
the many threads explaining all that. My concern is on how the various
methods in the actions are called, and how they pertain to security.
For example. Say you have a parameter="method" defined, as per the
example, and you pass method="addFoo" in the URL or even as a hidden
field. Struts will go and look through your action, see that addFoo
exists and do the processing. All is fine so far. However what if
someone decides to just type in the URL method="getServlet", and
getServlet() is a public method in Action, which DispatchAction extends,
or decides to type execute (which is not as much of a concern), will
using DispatchAction honor the call to getServlet or any other public
method in DispatchAction or Action classes?
Is there an easy way, besides extending the RequestProcessor (which is
not hard of course), to add a value to the parameter passed to the
DispatchAction? What I mean is that if I specify method="addFoo", I
want to add a string to my parameter value (the one specified for
DispatchAction) so before my action is processed and tries to resolve
addFoo(), I can add param_ so that it will look for param_addFoo method.
~ If I can do that, then anyone trying to make a call to execute,
getServlet or anything like that will cause the process to look for
param_execute() or param_getServlet(), both of which don't exist of
course, hence locking down the app some more.
Perhaps this shouldn't even be a concern?
Thanks for any input you can provide.
R
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQE/tONl+cV9vuB27SARArA+AJ9XfLVJhva7pFqptBjhFzdZEI87mACgijpx
5oIZW5PPWb9ufNeoFzMLcYQ=
=Yis4
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org