You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "Anthony Rumsey (JIRA)" <ji...@apache.org> on 2014/02/06 16:26:10 UTC
[jira] [Updated] (SLING-3379) OptingServlet accepts method bypassed
[ https://issues.apache.org/jira/browse/SLING-3379?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Anthony Rumsey updated SLING-3379:
----------------------------------
Component/s: Servlets
> OptingServlet accepts method bypassed
> -------------------------------------
>
> Key: SLING-3379
> URL: https://issues.apache.org/jira/browse/SLING-3379
> Project: Sling
> Issue Type: Bug
> Components: Servlets
> Reporter: Anthony Rumsey
>
> It is possible for the accepts method of the OptingServlet interface to be bypassed under certain conditions.
> For example consider a servlet called MyServlet that has a resourceType of "myapp/components/foo” and allows the POST method with a selector of “bar”. This servlet also implements the OptingServlet interface and has an ‘accepts’ method that checks the extension on the request.
> During some security testing I discovered that when I give a node a sling:resourceType of "myapp/components/foo.POST.servlet”, I can POST to this node with no selector and any extension I want which will still resolve to the MyServlet but not call the “accepts” method from the OptingServlet interface and goes directly to the doPost method.
--
This message was sent by Atlassian JIRA
(v6.1.5#6160)