Mailing-List: contact dev-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geronimo.apache.org
Received-SPF: pass (nike.apache.org: local policy)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
  s=dk20050327; d=earthlink.net;
  b=V+qTOwqbvHwZNTZk1SQjZkq2xuinu8hAHvvHoTtNfByWbSAZ7makpufWIjiC4Rw9;
  h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:References:In-Reply-To:Content-Type:Content-Transfer-Encoding:X-ELNK-Trace:X-Originating-IP;
Message-ID: <4A4A372B.6000707@earthlink.net>
Date: Tue, 30 Jun 2009 12:02:51 -0400
From: Joe Bohn <joe.bohn@earthlink.net>
User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605)
MIME-Version: 1.0
To: dev@geronimo.apache.org
Subject: Re: Session creation triggered by XSS/XSRF filter
References: <19C49411-7FD5-4D95-BCA9-20369A4AAAD7@gmail.com>
 <4A4A1CB6.2030503@apache.org> <4A4A2097.3080809@earthlink.net>
 <B42784D9-7620-4811-B79D-789D58D7C6BB@gmail.com>
In-Reply-To: <B42784D9-7620-4811-B79D-789D58D7C6BB@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Kevan Miller wrote:
> 
> On Jun 30, 2009, at 10:26 AM, Joe Bohn wrote:
> 
>> I tried some random URIs and always received a 404 back in my tests.
>>
>> This could be a problem with the filter on the welcome application.  
>> It currently has a context-root of "/" and the filter is registered 
>> with a URL pattern of "/*".
> 
> OK, that would explain it... So, is there any reason to run XSS 
> filtering on the welcome app?

I'm not sure if there is a strong reason to have the filter applied to 
the welcome application.  I have this vague recollection of somebody 
raising an issue earlier ... but I can't find any reference and after a 
quick glance I don't see any obvious exposures.

It primarily includes links into our wiki documentation along with a few 
other links (such as to the console and to subscribe to the mailing 
lists).
Perhaps the mail subscription links might present an exposure?
Or perhaps on the IRC link?

Does anybody have an idea if this is really necessary?  It seems like 
overkill to me.

Joe