geronimo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Donald Woods (JIRA)" <j...@apache.org>
Subject [jira] Created: (GERONIMO-4266) Upgrade to DWR 2.0.5 for XSS security fix
Date Tue, 26 Aug 2008 19:32:44 GMT
Upgrade to DWR 2.0.5 for XSS security fix
-----------------------------------------

                 Key: GERONIMO-4266
                 URL: https://issues.apache.org/jira/browse/GERONIMO-4266
             Project: Geronimo
          Issue Type: Bug
      Security Level: public (Regular issues)
          Components: dependencies
    Affects Versions: 2.1.2, 2.1.1, 2.1, 2.0.2, 2.0.1, 2.0, 2.0.3, 2.1.3, 2.2
            Reporter: Donald Woods
            Assignee: Donald Woods
             Fix For: 2.0.3, 2.1.3, 2.2


Need to upgrade to DWR 2.0.5 for the following fix -

------------------------------------------------------------------------
r2077 | joe | 2008-06-22 09:28:22 -0400 (Sun, 22 Jun 2008) | 7 lines

Fix for XSS issue in ExceptionHandler:

PartialResponse.fromOrdinal() throws a NumberFormatException trying to
parse the 'partialResponse' parameter.  This exception is never caught,
prompting UrlProcessor to invoke DWR's default ExceptionHandler class,
which calls out.println(cause.getMessage()), thereby causing the XSS.

------------------------------------------------------------------------


-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


Mime
View raw message