Mailing-List: contact dev-help@cocoon.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cocoon.apache.org
Message-ID: <090401c37084$d955d1e0$d767a8c0@kpiroumian>
From: "Konstantin Piroumian" <kpiroumian@apache.org>
To: <dev@cocoon.apache.org>
References: <3F530D3E.609@outerthought.org>
 <08c801c37074$54781920$d767a8c0@kpiroumian>
 <3F5324B2.4090806@outerthought.org>
Subject: Re: Lenient Woody Binding
Date: Mon, 1 Sep 2003 16:30:36 +0400
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

From: "Marc Portier" <mpo@outerthought.org>
> Konstantin Piroumian wrote:
> > From: "Marc Portier" <mpo@outerthought.org>
> >
> >>Hi all,
> >>
> >>
...
> >
> > There is also an option to use:
> >
> > context.createPathAndSetValue("address/zipCode", "90190");
> >
>
> nice to know!
>
>
> > to avoid NPEs or setting the lenient mode. This way you can be sure that
the
> > specified path will be created and the value is set to it. Though, I'm
not
> > sure if it's a good idea from security POV.
>
> why would you think it harms security?

Don't know how Woodie works, but if you use automatic binding then it's
possible that the user could send parameters like this:

/user/permissions=MyNewPermission

or something like that and modify things that he should not be able to touch
normally. Not sure if this is a good example, but anyway I don't like the
idea of allowing the user to create and set any desired values.

-- Konstantin