struts-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Ted Husted <ted.hus...@gmail.com>
Subject Re: Validation Security Hole?
Date Thu, 26 Jan 2006 17:48:29 GMT
On 1/26/06, Niall Pemberton <niall.pemberton@gmail.com> wrote:
> If the plan is to design for ww/action2, then more thought needs to go
> into the interface design - whether its simply a marker interface or
> includes some behaviour (e.g. a cancel() method) since getting it
> wrong is going to both be a pain for Struts 1.x and a legacy burden
> for Action 2. Its probably worth consulting the ww developers on
> whether they think its desirable to have this feature and the best way
> to implement it in ww/action2.

OK, let's make it "isCancellable" then and have it implement the
"IsCancelled" method that we already have. As I understand it, this
would be in line with the way most interceptors are implemented. This
would also leave room for another "Cancellable" implementation if
someone wanted to get into new development.

For good measure, we could deprecate the "isCancelled" method on the
Action class, so that people can start implementing the interface
instead. The idea being we would remove isCancelled from the Action
class in Struts Action 1.4, should there be one. In a 1.4 series, we
could then change the default to TRUE, since anyone who is calling
isCancelled should have resolved the deprecation warning and
implemented the interface instead.

IMHO, the key issue is that we let people who care disable the
special-case handling for the cancel token. We can work toward making
"opt-in" the default behavior for the cancel handling, but I don't
think it is such a burning issue that we have to do it in one fell
swoop. We can stick to the usual deprecate-replace-remove strategy.

Whether this is an API oversight or a security issue is debatable, and
so the important thing is that we provide a fix for applications where
the special-case handling might be an issue.

-Ted.

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org


Mime
View raw message