myfaces-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Leonardo Uribe (Updated) (JIRA)" <...@myfaces.apache.org>
Subject [jira] [Updated] (MYFACES-3405) includeViewParameters re-evaluates param/model values as EL expressions
Date Tue, 22 Nov 2011 21:52:40 GMT

     [ https://issues.apache.org/jira/browse/MYFACES-3405?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Leonardo Uribe updated MYFACES-3405:
------------------------------------

    Status: Patch Available  (was: Open)
    
> includeViewParameters re-evaluates param/model values as EL expressions
> -----------------------------------------------------------------------
>
>                 Key: MYFACES-3405
>                 URL: https://issues.apache.org/jira/browse/MYFACES-3405
>             Project: MyFaces Core
>          Issue Type: Bug
>    Affects Versions: 2.1.3
>         Environment: MyFaces 2.1.3
>            Reporter: Frederick Kämpfer
>         Attachments: MYFACES-3405-1.patch
>
>
> I just wanted to make you aware of the following security issue in conjunction with the
includeViewParameters navigation parameter. It seems it is also reproducible with MyFaces:
> http://java.net/jira/browse/JAVASERVERFACES-2247
> I'm not sure which workaround would be best in accordance with the Spec, but at least
a quick fix might be worth considering to improve the security of the default behavior.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira

       

Mime
View raw message