Return-Path: Delivered-To: apmail-myfaces-users-archive@www.apache.org Received: (qmail 14820 invoked from network); 12 Mar 2008 11:37:10 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2) by minotaur.apache.org with SMTP; 12 Mar 2008 11:37:10 -0000 Received: (qmail 67718 invoked by uid 500); 12 Mar 2008 11:37:03 -0000 Delivered-To: apmail-myfaces-users-archive@myfaces.apache.org Received: (qmail 67487 invoked by uid 500); 12 Mar 2008 11:37:02 -0000 Mailing-List: contact users-help@myfaces.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "MyFaces Discussion" Delivered-To: mailing list users@myfaces.apache.org Received: (qmail 67476 invoked by uid 99); 12 Mar 2008 11:37:02 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 12 Mar 2008 04:37:02 -0700 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of lukasz.budnik@gmail.com designates 209.85.200.171 as permitted sender) Received: from [209.85.200.171] (HELO wf-out-1314.google.com) (209.85.200.171) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 12 Mar 2008 11:36:25 +0000 Received: by wf-out-1314.google.com with SMTP id 29so2850056wff.24 for ; Wed, 12 Mar 2008 04:36:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; bh=/ojuVy8OdjvVt+DZ9sgC3xh2v3w2EHjh0pIlABQVy7c=; b=TNuq5dk6uHP0PyOy7yqtBoC2gM2NGCRihGLVyzKB6xpJaHmcaRhVTEm25UpyNk5bvK6/GEFez7Nafe3v76UD+PBX5sxTjDIiiqjPUn41LAS6gxJG1aFsN4kCbGRwCAR7wplNI34mr2EvcVp0Z1U4GHno60I9CqwnwszsVqkgTvE= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=urDWxBuFC6j/Gqb1GpOVYXiKbFV0RXdO8qjfS/3onsulmnKLzlINb7ySIc8MMU1iwLlIKfLYDjz7XqpK9DWwduPL29x4gsvzcg2ZMdRR9FtNuN/hu6ePcF6AVP8mksuwrEjZyGQb1cvuYu0sL06y17n45ZT/EQcXuacA3sZSaMM= Received: by 10.142.174.8 with SMTP id w8mr3278994wfe.5.1205321795863; Wed, 12 Mar 2008 04:36:35 -0700 (PDT) Received: by 10.143.34.1 with HTTP; Wed, 12 Mar 2008 04:36:35 -0700 (PDT) Message-ID: <9e999ed80803120436m720cd808m8bdbfd5127be7a61@mail.gmail.com> Date: Wed, 12 Mar 2008 12:36:35 +0100 From: "=?UTF-8?Q?=C5=81ukasz_Budnik?=" To: "MyFaces Discussion" Subject: Re: serious security BUG in MyFaces 1.2.2 In-Reply-To: <9e999ed80803111753q75f00abdpf1a9663953e116ff@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: base64 Content-Disposition: inline References: <9e999ed80803111753q75f00abdpf1a9663953e116ff@mail.gmail.com> X-Virus-Checked: Checked by ClamAV on apache.org SGkgQWxsIQoKSSd2ZSB3cml0dGVuIHZlcnkgc2ltcGxlIHdvcmsgYXJvdW5kIGZvciB0aGlzLiBJ IHVzZSBzZXNzaW9uIGJhY2tpbmcKYmVhbjogQXV0aG9yaXphdGlvbkNvbnRyb2xsZXIgdG8gc3Rv cmUgdXNlciBhbmQgaGlzL2hlcnMgcm9sZXMgYW5kCkF1dGhvcml6YXRpb25QaGFzZUxpc3RlbmVy IHRvIHJldHJpZXZlIHRoZSByb2xlcyBhbmQgdXNlcnMgZnJvbSB0aGUKb3JpZ2luYWwgcmVxdWVz dC4KClRoaXMgaXMgaG93IGl0IGxvb2tzIGxpa2U6CgpwdWJsaWMgY2xhc3MgQXV0aG9yaXphdGlv blBoYXNlTGlzdGVuZXIgaW1wbGVtZW50cyBQaGFzZUxpc3RlbmVyIHsKCglwcml2YXRlIHN0YXRp YyBmaW5hbCBsb25nIHNlcmlhbFZlcnNpb25VSUQgPSAyMDc4OTczMTI2OTQyMTU5MTU1TDsKCglw cm90ZWN0ZWQgZmluYWwgc3RhdGljIExvZ2dlciBsb2dnZXIgPSBMb2dnZXIKCQkJLmdldExvZ2dl cihBdXRob3JpemF0aW9uUGhhc2VMaXN0ZW5lci5jbGFzcyk7CgoJQFN1cHByZXNzV2FybmluZ3Mo ImRlcHJlY2F0aW9uIikKCXB1YmxpYyB2b2lkIGFmdGVyUGhhc2UoUGhhc2VFdmVudCBwaGFzZUV2 ZW50KSB7CgkJRmFjZXNDb250ZXh0IGZhY2VzQ29udGV4dCA9IHBoYXNlRXZlbnQuZ2V0RmFjZXND b250ZXh0KCk7CgoJCS8vIGNoZWNrIGlmIHVzZXIgaGFzIGJlZW4gYXV0aG9yaXplZCBieSBKQUFT LCBpZiBub3QgcmV0dXJuCgkJaWYgKGZhY2VzQ29udGV4dC5nZXRFeHRlcm5hbENvbnRleHQoKS5n ZXRSZW1vdGVVc2VyKCkgPT0gbnVsbCkgewoJCQlyZXR1cm47CgkJfQoKCQkvLyB0aGVyZSBpcyBh IHJlbW90ZSB1c2VyIHNldCBieSBKQUFTCgoJCS8vIE15RmFjZXMgMS4yLjIgc2VjdXJpdHkgYnVn LCBjYW5ub3QgcmV0cmlldmUgbWFuYWdlZCBiZWFuIGJlY2F1c2UgaXQKCQkvLyBlcmFzZXMgYWxs IHJvbGVzLCBjb3B5IHRoZW0gYmVmb3JlIDspCgkJTWFwPFN0cmluZywgQm9vbGVhbj4gcm9sZXNN YXAgPSBuZXcgSGFzaE1hcDxTdHJpbmcsIEJvb2xlYW4+KDQpOwoJCVN0cmluZ1tdIHJvbGVzID0g bmV3IFN0cmluZ1tdIHsgInZpZXdlciIsICJleGVjdXRvciIsICJjcmVhdG9yIiwKCQkJCSJhZG1p biIgfTsKCgkJZm9yIChTdHJpbmcgcm9sZSA6IHJvbGVzKSB7CgkJCWxvZ2dlci5kZWJ1ZygiSXMg dXNlciBpbiAnIgoJCQkJCSsgcm9sZQoJCQkJCSsgIicgcm9sZT8gPT0+ICIKCQkJCQkrIHBoYXNl RXZlbnQuZ2V0RmFjZXNDb250ZXh0KCkuZ2V0RXh0ZXJuYWxDb250ZXh0KCkKCQkJCQkJCS5pc1Vz ZXJJblJvbGUocm9sZSkpOwoJCQlyb2xlc01hcC5wdXQocm9sZSwgcGhhc2VFdmVudC5nZXRGYWNl c0NvbnRleHQoKQoJCQkJCS5nZXRFeHRlcm5hbENvbnRleHQoKS5pc1VzZXJJblJvbGUocm9sZSkp OwoJCX0KCgkJQXV0aG9yaXphdGlvbkNvbnRyb2xsZXIgYXV0aG9yaXphdGlvbkNvbnRyb2xsZXIg PQooQXV0aG9yaXphdGlvbkNvbnRyb2xsZXIpIGZhY2VzQ29udGV4dAoJCQkJLmdldEFwcGxpY2F0 aW9uKCkuY3JlYXRlVmFsdWVCaW5kaW5nKAoJCQkJCQkiI3tBdXRob3JpemF0aW9uQ29udHJvbGxl cn0iKS5nZXRWYWx1ZShmYWNlc0NvbnRleHQpOwoKCQlsb2dnZXIuZGVidWcoIlJlbW90ZSB1c2Vy IGlzID09PiAiCgkJCQkrIGZhY2VzQ29udGV4dC5nZXRFeHRlcm5hbENvbnRleHQoKS5nZXRSZW1v dGVVc2VyKCkpOwoJCWxvZ2dlci5kZWJ1ZygiQXV0aG9yaXplZCB1c2VyIGlzID09PiAiCgkJCQkr IGF1dGhvcml6YXRpb25Db250cm9sbGVyLmdldFVzZXIoKSk7CgoJCS8vIGlmIHVzZXIgaXMgYWxy ZWFkeSBhdXRob3JpemVkLCByZXR1cm4KCQlpZiAoYXV0aG9yaXphdGlvbkNvbnRyb2xsZXIuZ2V0 VXNlcigpICE9IG51bGwKCQkJCSYmIGZhY2VzQ29udGV4dC5nZXRFeHRlcm5hbENvbnRleHQoKS5n ZXRSZW1vdGVVc2VyKCkgIT0gbnVsbCkgewoJCQlyZXR1cm47CgkJfQoKCQkvLyBpZiBub3QsIHBy b2NlZWQKCgkJLy8gbG9hZCB1c2VyCgkJYXV0aG9yaXphdGlvbkNvbnRyb2xsZXIubG9hZFVzZXIo ZmFjZXNDb250ZXh0LmdldEV4dGVybmFsQ29udGV4dCgpCgkJCQkuZ2V0UmVtb3RlVXNlcigpKTsK CgkJLy8gYW5kIHNldCBwcm9wZXIgcm9sZXMKCQlmb3IgKFN0cmluZyByb2xlIDogcm9sZXNNYXAu a2V5U2V0KCkpIHsKCQkJaWYgKHJvbGVzTWFwLmdldChyb2xlKSkgewoJCQkJYXV0aG9yaXphdGlv bkNvbnRyb2xsZXIuc2V0Um9sZShyb2xlKTsKCQkJfQoJCX0KCgl9CgoJcHVibGljIHZvaWQgYmVm b3JlUGhhc2UoUGhhc2VFdmVudCBwaGFzZUV2ZW50KSB7Cgl9CgoJcHVibGljIFBoYXNlSWQgZ2V0 UGhhc2VJZCgpIHsKCQlyZXR1cm4gUGhhc2VJZC5SRVNUT1JFX1ZJRVc7Cgl9Cgp9CgoKbm93LCBp bnNpZGUgYW55IHZpZXcgSSBjYW4gbm93IHVzZXIgZm9yIGV4YW1wbGUKcmVuZGVyZWQ9IiN7QXV0 aG9yaXphdGlvbkNvbnRyb2xsZXIuYWRtaW59IgoKYmVzdCByZWdhcmRzCsWBdWthc3oKCk9uIDEy LzAzLzIwMDgsIMWBdWthc3ogQnVkbmlrIDxsdWthc3ouYnVkbmlrQGdtYWlsLmNvbT4gd3JvdGU6 Cj4gSGkgQWxsIQo+Cj4gIEkgaGFkIHNvbWUgdHJvdWJsZSB3aXRoIFRvbWFoYXdrJ3MgdmlzaWJs ZU9uVXNlclJvbGUuCj4gIEFsc28sIEkndmUgdHJpZWQgdGhlIHNlY3VyaXR5Q29udGV4dCBmcm9t IFRvbWFoYXdrIFNhbmRib3gsIGJ1dCBpdAo+ICBkaWRuJ3Qgd29yayBlaXRoZXIuCj4KPiAgSSd2 ZSB3cml0dGVuIHNpbXBsZSB0ZXN0cywgaW4gZXZlcnkgY2FzZSBJIHVzZSBmb2xsb3dpbmcgYXJy YXkgb2Ygcm9sZXM6Cj4KPiAgU3RyaW5nW10gcm9sZXMgPSBuZXcgU3RyaW5nW10geyAidmlld2Vy IiwgImV4ZWN1dG9yIiwgImNyZWF0b3IiLCAiYWRtaW4iIH07Cj4KPiAgaW5zaWRlIFRlc3RGaWx0 ZXIuZG9GaWx0ZXIgSSBoYXZlOgo+Cj4gIGZvciAoU3RyaW5nIHJvbGUgOiByb2xlcykgewo+ICAg ICAgICAgbG9nZ2VyLmRlYnVnKCJJcyB1c2VyIGluICciICsgcm9sZSArICInIHJvbGU/ID09PiAi Cj4gICAgICAgICArICgoSHR0cFNlcnZsZXRSZXF1ZXN0KSByZXF1ZXN0KS5pc1VzZXJJblJvbGUo cm9sZSkpOwo+ICB9Cj4KPiAgaW5zaWRlIFRlc3RQaGFzZUxpc3RlbmVyLmFmdGVyUGhhc2UvYmVm b3JlUGhhc2U6Cj4KPiAgZm9yIChTdHJpbmcgcm9sZSA6IHJvbGVzKSB7Cj4gICAgICAgICBsb2dn ZXIuZGVidWcoIioqYWZ0ZXIvYmVmb3JlKiogcGhhc2UgSXMgdXNlciBpbiAnIiArIHJvbGUgKyAi JyByb2xlPyA9PT4gIgo+ICAgICAgICAgKyBwaGFzZUV2ZW50LmdldEZhY2VzQ29udGV4dCgpLmdl dEV4dGVybmFsQ29udGV4dCgpLmlzVXNlckluUm9sZShyb2xlKSk7Cj4gIH0KPgo+ICBhbmQgZmlu YWxseSBpbnNpZGUgVGVzdEJhY2tpbmdCZWFuIEkgaGF2ZSB0d28gbG9vcHM6Cj4KPiAgZm9yIChT dHJpbmcgcm9sZSA6IHJvbGVzKSB7Cj4gICAgICAgICBsb2dnZXIuZGVidWcoIklzIHVzZXIgaW4g JyIgKyByb2xlICsgIicgcm9sZT8gPT0+ICIKPiAgICAgICAgICsgRmFjZXNDb250ZXh0LmdldEN1 cnJlbnRJbnN0YW5jZSgpLmdldEV4dGVybmFsQ29udGV4dCgpLmlzVXNlckluUm9sZShyb2xlKSk7 Cj4gIH0KPiAgZm9yIChTdHJpbmcgcm9sZSA6IHJvbGVzKSB7Cj4gICAgICAgICBsb2dnZXIuZGVi dWcoIklzIHVzZXIgaW4gJyIgKyByb2xlICsgIicgcm9sZT8gPT0+ICIKPiAgICAgICAgICsgKCAo SHR0cFNlcnZsZXRSZXF1ZXN0KQo+ICBGYWNlc0NvbnRleHQuZ2V0Q3VycmVudEluc3RhbmNlKCku Z2V0RXh0ZXJuYWxDb250ZXh0KCkuZ2V0UmVxdWVzdCgpKS5pc1VzZXJJblJvbGUocm9sZSkpOwo+ ICB9Cj4KPiAgYWZ0ZXIgc3VjY2Vzc2Z1bCBzaWduaW5nIGluLCBJIGJyb3dzZSBhIHJhbmRvbSBw YWdlLCBhbmQgaGVyZSdzIHdoYXQgSQo+ICBzZWUgaW4gbXkgbG9nOgo+Cj4gIGZpcnN0IGNvbnRy b2wgZmxvdyBnb2VzIHRvIHRoZSBmaWx0ZXI6Cj4KPiAgMDE6Mjc6MjgsMDAwIERFQlVHIFtUZXN0 RmlsdGVyXSBJcyB1c2VyIGluICd2aWV3ZXInIHJvbGU/ID09PiB0cnVlCj4gIDAxOjI3OjI4LDAw MCBERUJVRyBbVGVzdEZpbHRlcl0gSXMgdXNlciBpbiAnZXhlY3V0b3InIHJvbGU/ID09PiB0cnVl Cj4gIDAxOjI3OjI4LDAwMCBERUJVRyBbVGVzdEZpbHRlcl0gSXMgdXNlciBpbiAnY3JlYXRvcicg cm9sZT8gPT0+IHRydWUKPiAgMDE6Mjc6MjgsMDAwIERFQlVHIFtUZXN0RmlsdGVyXSBJcyB1c2Vy IGluICdhZG1pbicgcm9sZT8gPT0+IHRydWUKPgo+ICBhcyBleHBlY3RlZCA7KQo+Cj4gIG5vdywg TXlGYWNlcyBiZWZvcmVQaGFzZToKPgo+ICAwMToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxp c3RlbmVyXSBiZWZvcmUgcGhhc2UgSXMgdXNlciBpbgo+ICAndmlld2VyJyByb2xlPyA9PT4gdHJ1 ZQo+ICAwMToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxpc3RlbmVyXSBiZWZvcmUgcGhhc2Ug SXMgdXNlciBpbgo+ICAnZXhlY3V0b3InIHJvbGU/ID09PiB0cnVlCj4gIDAxOjI3OjI4LDAxNSBE RUJVRyBbVGVzdFBoYXNlTGlzdGVuZXJdIGJlZm9yZSBwaGFzZSBJcyB1c2VyIGluCj4gICdjcmVh dG9yJyByb2xlPyA9PT4gdHJ1ZQo+ICAwMToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxpc3Rl bmVyXSBiZWZvcmUgcGhhc2UgSXMgdXNlciBpbiAnYWRtaW4nCj4gIHJvbGU/ID09PiB0cnVlCj4K PiAgcGVyZmVjdCEKPgo+ICBhbmQgYWZ0ZXJQaGFzZToKPgo+ICAwMToyNzoyOCwwMTUgREVCVUcg W1Rlc3RQaGFzZUxpc3RlbmVyXSBhZnRlciBwaGFzZSBJcyB1c2VyIGluICd2aWV3ZXInCj4gIHJv bGU/ID09PiB0cnVlCj4gIDAxOjI3OjI4LDAxNSBERUJVRyBbVGVzdFBoYXNlTGlzdGVuZXJdIGFm dGVyIHBoYXNlIElzIHVzZXIgaW4KPiAgJ2V4ZWN1dG9yJyByb2xlPyA9PT4gdHJ1ZQo+ICAwMToy NzoyOCwwMTUgREVCVUcgW1Rlc3RQaGFzZUxpc3RlbmVyXSBhZnRlciBwaGFzZSBJcyB1c2VyIGlu Cj4gICdjcmVhdG9yJyByb2xlPyA9PT4gdHJ1ZQo+ICAwMToyNzoyOCwwMTUgREVCVUcgW1Rlc3RQ aGFzZUxpc3RlbmVyXSBhZnRlciBwaGFzZSBJcyB1c2VyIGluICdhZG1pbicKPiAgcm9sZT8gPT0+ IHRydWUKPgo+ICBjb3VsZG4ndCBiZSBiZXR0ZXIhCj4KPgo+ICBCVVQgOygKPgo+ICBpbnNpZGUg dGhlIGJhY2tpbmcgYmVhbjoKPgo+ICAwMToyNzoyOCwxNzEgREVCVUcgW1Rlc3RCYWNraW5nQmVh bl0gSXMgdXNlciBpbiAndmlld2VyJyByb2xlPyA9PT4gZmFsc2UKPiAgMDE6Mjc6MjgsMTcxIERF QlVHIFtUZXN0QmFja2luZ0JlYW5dIElzIHVzZXIgaW4gJ2V4ZWN1dG9yJyByb2xlPyA9PT4gZmFs c2UKPiAgMDE6Mjc6MjgsMTcxIERFQlVHIFtUZXN0QmFja2luZ0JlYW5dIElzIHVzZXIgaW4gJ2Ny ZWF0b3InIHJvbGU/ID09PiBmYWxzZQo+ICAwMToyNzoyOCwxNzEgREVCVUcgW1Rlc3RCYWNraW5n QmVhbl0gSXMgdXNlciBpbiAnYWRtaW4nIHJvbGU/ID09PiBmYWxzZQo+ICAwMToyNzoyOCwxODcg REVCVUcgW1Rlc3RCYWNraW5nQmVhbl0gSXMgdXNlciBpbiAndmlld2VyJyByb2xlPyA9PT4gZmFs c2UKPiAgMDE6Mjc6MjgsMTg3IERFQlVHIFtUZXN0QmFja2luZ0JlYW5dIElzIHVzZXIgaW4gJ2V4 ZWN1dG9yJyByb2xlPyA9PT4gZmFsc2UKPiAgMDE6Mjc6MjgsMTg3IERFQlVHIFtUZXN0QmFja2lu Z0JlYW5dIElzIHVzZXIgaW4gJ2NyZWF0b3InIHJvbGU/ID09PiBmYWxzZQo+ICAwMToyNzoyOCwx ODcgREVCVUcgW1Rlc3RCYWNraW5nQmVhbl0gSXMgdXNlciBpbiAnYWRtaW4nIHJvbGU/ID09PiBm YWxzZQo+Cj4gIGRpc2FzdGVyIQo+Cj4gIHNlY3VyaXR5IGluIE15RmFjZXMgMS4yLjIgZG9lcyBu b3Qgd29yayBhdCBhbGwgKGV4Y2VwdCBmb3IgcGhhc2UKPiAgbGlzdGVuZXJzLCB3aGljaCBpcyB1 c2VsZXNzIGZvciBtZSBhbnl3YXkpLgo+Cj4gIGFueSBpZGVhIGhvdyB0byBmaXggaXQ/Cj4KPiAg YmVzdCByZWdhcmRzCj4KPiDFgXVrYXN6Cj4K