Return-Path: Delivered-To: apmail-myfaces-users-archive@www.apache.org Received: (qmail 97695 invoked from network); 12 Mar 2008 00:54:20 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 12 Mar 2008 00:54:20 -0000 Received: (qmail 9140 invoked by uid 500); 12 Mar 2008 00:54:13 -0000 Delivered-To: apmail-myfaces-users-archive@myfaces.apache.org Received: (qmail 9099 invoked by uid 500); 12 Mar 2008 00:54:13 -0000 Mailing-List: contact users-help@myfaces.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "MyFaces Discussion" Delivered-To: mailing list users@myfaces.apache.org Received: (qmail 9088 invoked by uid 99); 12 Mar 2008 00:54:13 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 11 Mar 2008 17:54:13 -0700 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of lukasz.budnik@gmail.com designates 64.233.184.228 as permitted sender) Received: from [64.233.184.228] (HELO wr-out-0506.google.com) (64.233.184.228) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 12 Mar 2008 00:53:37 +0000 Received: by wr-out-0506.google.com with SMTP id 57so2007480wri.12 for ; Tue, 11 Mar 2008 17:53:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=m+IyHd9Xhb2+sgWdoQ/l8/K+fvL7YEU/6NBcYQIQ6To=; b=tWoq8C8OMOVB3lAhq20HekPbxLBF9uumShOypgOUlRzFSKFeK8cK1zar41qnE4WuZz+QamEQDPaReBt4K/O5X24dR/r0KUY0YXMs/ouj9pQGs9Z5OEPhxuL5ccar3zPl3xTU1hHBG1dDnVjOE2wW97LcqD0NXBmQKLtvVgcifWM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=ArLI1tWy+PndfbN8y1glVo7YlYpOl8Sj5AArjse+dYM7mVyCq19mG2EQ/DUbFHggPvxfCYLS0RUzh77PgfICsjgYdd7YVGVnr8pJfmEzeO6W6eob5xOMfVUZ+3yW0RZitMMsYMJGKQKKYfzHqNlbVNXQ3+NXl6SoYelDknBkGSc= Received: by 10.142.141.21 with SMTP id o21mr3194311wfd.56.1205283227103; Tue, 11 Mar 2008 17:53:47 -0700 (PDT) Received: by 10.143.34.1 with HTTP; Tue, 11 Mar 2008 17:53:46 -0700 (PDT) Message-ID: <9e999ed80803111753q75f00abdpf1a9663953e116ff@mail.gmail.com> Date: Wed, 12 Mar 2008 01:53:46 +0100 From: "=?UTF-8?Q?=C5=81ukasz_Budnik?=" To: "MyFaces Discussion" Subject: serious security BUG in MyFaces 1.2.2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 Content-Disposition: inline X-Virus-Checked: Checked by ClamAV on apache.org SGkgQWxsIQoKSSBoYWQgc29tZSB0cm91YmxlIHdpdGggVG9tYWhhd2sncyB2aXNpYmxlT25Vc2Vy Um9sZS4KQWxzbywgSSd2ZSB0cmllZCB0aGUgc2VjdXJpdHlDb250ZXh0IGZyb20gVG9tYWhhd2sg U2FuZGJveCwgYnV0IGl0CmRpZG4ndCB3b3JrIGVpdGhlci4KCkkndmUgd3JpdHRlbiBzaW1wbGUg dGVzdHMsIGluIGV2ZXJ5IGNhc2UgSSB1c2UgZm9sbG93aW5nIGFycmF5IG9mIHJvbGVzOgoKU3Ry aW5nW10gcm9sZXMgPSBuZXcgU3RyaW5nW10geyAidmlld2VyIiwgImV4ZWN1dG9yIiwgImNyZWF0 b3IiLCAiYWRtaW4iIH07CgppbnNpZGUgVGVzdEZpbHRlci5kb0ZpbHRlciBJIGhhdmU6Cgpmb3Ig KFN0cmluZyByb2xlIDogcm9sZXMpIHsKCWxvZ2dlci5kZWJ1ZygiSXMgdXNlciBpbiAnIiArIHJv bGUgKyAiJyByb2xlPyA9PT4gIgoJKyAoKEh0dHBTZXJ2bGV0UmVxdWVzdCkgcmVxdWVzdCkuaXNV c2VySW5Sb2xlKHJvbGUpKTsKfQoKaW5zaWRlIFRlc3RQaGFzZUxpc3RlbmVyLmFmdGVyUGhhc2Uv YmVmb3JlUGhhc2U6Cgpmb3IgKFN0cmluZyByb2xlIDogcm9sZXMpIHsKCWxvZ2dlci5kZWJ1Zygi KiphZnRlci9iZWZvcmUqKiBwaGFzZSBJcyB1c2VyIGluICciICsgcm9sZSArICInIHJvbGU/ID09 PiAiCgkrIHBoYXNlRXZlbnQuZ2V0RmFjZXNDb250ZXh0KCkuZ2V0RXh0ZXJuYWxDb250ZXh0KCku aXNVc2VySW5Sb2xlKHJvbGUpKTsKfQoKYW5kIGZpbmFsbHkgaW5zaWRlIFRlc3RCYWNraW5nQmVh biBJIGhhdmUgdHdvIGxvb3BzOgoKZm9yIChTdHJpbmcgcm9sZSA6IHJvbGVzKSB7Cglsb2dnZXIu ZGVidWcoIklzIHVzZXIgaW4gJyIgKyByb2xlICsgIicgcm9sZT8gPT0+ICIKCSsgRmFjZXNDb250 ZXh0LmdldEN1cnJlbnRJbnN0YW5jZSgpLmdldEV4dGVybmFsQ29udGV4dCgpLmlzVXNlckluUm9s ZShyb2xlKSk7Cn0KZm9yIChTdHJpbmcgcm9sZSA6IHJvbGVzKSB7Cglsb2dnZXIuZGVidWcoIklz IHVzZXIgaW4gJyIgKyByb2xlICsgIicgcm9sZT8gPT0+ICIKCSsgKCAoSHR0cFNlcnZsZXRSZXF1 ZXN0KQpGYWNlc0NvbnRleHQuZ2V0Q3VycmVudEluc3RhbmNlKCkuZ2V0RXh0ZXJuYWxDb250ZXh0 KCkuZ2V0UmVxdWVzdCgpKS5pc1VzZXJJblJvbGUocm9sZSkpOwp9CgphZnRlciBzdWNjZXNzZnVs IHNpZ25pbmcgaW4sIEkgYnJvd3NlIGEgcmFuZG9tIHBhZ2UsIGFuZCBoZXJlJ3Mgd2hhdCBJCnNl ZSBpbiBteSBsb2c6CgpmaXJzdCBjb250cm9sIGZsb3cgZ29lcyB0byB0aGUgZmlsdGVyOgoKMDE6 Mjc6MjgsMDAwIERFQlVHIFtUZXN0RmlsdGVyXSBJcyB1c2VyIGluICd2aWV3ZXInIHJvbGU/ID09 PiB0cnVlCjAxOjI3OjI4LDAwMCBERUJVRyBbVGVzdEZpbHRlcl0gSXMgdXNlciBpbiAnZXhlY3V0 b3InIHJvbGU/ID09PiB0cnVlCjAxOjI3OjI4LDAwMCBERUJVRyBbVGVzdEZpbHRlcl0gSXMgdXNl ciBpbiAnY3JlYXRvcicgcm9sZT8gPT0+IHRydWUKMDE6Mjc6MjgsMDAwIERFQlVHIFtUZXN0Rmls dGVyXSBJcyB1c2VyIGluICdhZG1pbicgcm9sZT8gPT0+IHRydWUKCmFzIGV4cGVjdGVkIDspCgpu b3csIE15RmFjZXMgYmVmb3JlUGhhc2U6CgowMToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxp c3RlbmVyXSBiZWZvcmUgcGhhc2UgSXMgdXNlciBpbgondmlld2VyJyByb2xlPyA9PT4gdHJ1ZQow MToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxpc3RlbmVyXSBiZWZvcmUgcGhhc2UgSXMgdXNl ciBpbgonZXhlY3V0b3InIHJvbGU/ID09PiB0cnVlCjAxOjI3OjI4LDAxNSBERUJVRyBbVGVzdFBo YXNlTGlzdGVuZXJdIGJlZm9yZSBwaGFzZSBJcyB1c2VyIGluCidjcmVhdG9yJyByb2xlPyA9PT4g dHJ1ZQowMToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxpc3RlbmVyXSBiZWZvcmUgcGhhc2Ug SXMgdXNlciBpbiAnYWRtaW4nCnJvbGU/ID09PiB0cnVlCgpwZXJmZWN0IQoKYW5kIGFmdGVyUGhh c2U6CgowMToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxpc3RlbmVyXSBhZnRlciBwaGFzZSBJ cyB1c2VyIGluICd2aWV3ZXInCnJvbGU/ID09PiB0cnVlCjAxOjI3OjI4LDAxNSBERUJVRyBbVGVz dFBoYXNlTGlzdGVuZXJdIGFmdGVyIHBoYXNlIElzIHVzZXIgaW4KJ2V4ZWN1dG9yJyByb2xlPyA9 PT4gdHJ1ZQowMToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxpc3RlbmVyXSBhZnRlciBwaGFz ZSBJcyB1c2VyIGluCidjcmVhdG9yJyByb2xlPyA9PT4gdHJ1ZQowMToyNzoyOCwwMTUgREVCVUcg W1Rlc3RQaGFzZUxpc3RlbmVyXSBhZnRlciBwaGFzZSBJcyB1c2VyIGluICdhZG1pbicKcm9sZT8g PT0+IHRydWUKCmNvdWxkbid0IGJlIGJldHRlciEKCgpCVVQgOygKCmluc2lkZSB0aGUgYmFja2lu ZyBiZWFuOgoKMDE6Mjc6MjgsMTcxIERFQlVHIFtUZXN0QmFja2luZ0JlYW5dIElzIHVzZXIgaW4g J3ZpZXdlcicgcm9sZT8gPT0+IGZhbHNlCjAxOjI3OjI4LDE3MSBERUJVRyBbVGVzdEJhY2tpbmdC ZWFuXSBJcyB1c2VyIGluICdleGVjdXRvcicgcm9sZT8gPT0+IGZhbHNlCjAxOjI3OjI4LDE3MSBE RUJVRyBbVGVzdEJhY2tpbmdCZWFuXSBJcyB1c2VyIGluICdjcmVhdG9yJyByb2xlPyA9PT4gZmFs c2UKMDE6Mjc6MjgsMTcxIERFQlVHIFtUZXN0QmFja2luZ0JlYW5dIElzIHVzZXIgaW4gJ2FkbWlu JyByb2xlPyA9PT4gZmFsc2UKMDE6Mjc6MjgsMTg3IERFQlVHIFtUZXN0QmFja2luZ0JlYW5dIElz IHVzZXIgaW4gJ3ZpZXdlcicgcm9sZT8gPT0+IGZhbHNlCjAxOjI3OjI4LDE4NyBERUJVRyBbVGVz dEJhY2tpbmdCZWFuXSBJcyB1c2VyIGluICdleGVjdXRvcicgcm9sZT8gPT0+IGZhbHNlCjAxOjI3 OjI4LDE4NyBERUJVRyBbVGVzdEJhY2tpbmdCZWFuXSBJcyB1c2VyIGluICdjcmVhdG9yJyByb2xl PyA9PT4gZmFsc2UKMDE6Mjc6MjgsMTg3IERFQlVHIFtUZXN0QmFja2luZ0JlYW5dIElzIHVzZXIg aW4gJ2FkbWluJyByb2xlPyA9PT4gZmFsc2UKCmRpc2FzdGVyIQoKc2VjdXJpdHkgaW4gTXlGYWNl cyAxLjIuMiBkb2VzIG5vdCB3b3JrIGF0IGFsbCAoZXhjZXB0IGZvciBwaGFzZQpsaXN0ZW5lcnMs IHdoaWNoIGlzIHVzZWxlc3MgZm9yIG1lIGFueXdheSkuCgphbnkgaWRlYSBob3cgdG8gZml4IGl0 PwoKYmVzdCByZWdhcmRzCsWBdWthc3oK