Mailing-List: contact dev-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Developers List" <dev@struts.apache.org>
Received-SPF: pass (herse.apache.org: domain of
 the.mindstorm.mailinglist@gmail.com designates 209.85.146.182 as permitted
 sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=sxylNHTYwoXgTLk7IhJQRPLI2Jd/DlO+mnEIs2ZrYgZtU9ANxaJRGiKmVSOISZTORS2BeL3MC/Vsvek4qFSuRoGb58o+POEBdjCLhwUra1XLL23K/qGw2DhG2JQR4hh5n/dWvzfBz1FdIBqqKcFyCnEPrtYaqDL61/H3CpXuLjE=
Message-ID: <c6f400460707160929i21bc6825rf9600633180c6f72@mail.gmail.com>
Date: Mon, 16 Jul 2007 19:29:09 +0300
From: "=?UTF-8?Q?Alexandru_Popescu_=E2=98=80?="
 <the.mindstorm.mailinglist@gmail.com>
To: "Struts Developers List" <dev@struts.apache.org>
Subject: Re: Preventing OGNL evaluations of user input (was Re: Struts 2
 performance)
In-Reply-To: <aae96ca0707160855y1ea871b7ka2e410147ca4ff6a@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <1c661f2f0707152355g2efd8913h5448d5a23df25cb2@mail.gmail.com>
	 <1c661f2f0707160449m42ce01afnd281406cb5a6e284@mail.gmail.com>
	 <1184588807.22613.1200363959@webmail.messagingengine.com>
	 <436d9a250707160536m472afdfbj4e206156a26e435@mail.gmail.com>
	 <d8bdeb6f0707160632o601d0efbq414914c44f39b7cb@mail.gmail.com>
	 <436d9a250707160638j247768f4pbc1cfd8def52a256@mail.gmail.com>
	 <7D6CA52B-639D-4BA2-9726-0FE0FDAC286B@andreavettori.com>
	 <aae96ca0707160709y56fe4cfdx58a054005500b4e6@mail.gmail.com>
	 <469B931F.5020702@fdar.com>
	 <aae96ca0707160855y1ea871b7ka2e410147ca4ff6a@mail.gmail.com>

On 7/16/07, Antonio Petrelli <antonio.petrelli@gmail.com> wrote:
> 2007/7/16, Ian Roughley <ian@fdar.com>:
> >
> > What do you define as "a user should not be allowed to execute such OGNL
> > code!"?  There are times that I want to call a static method and use the
> > results.  The problem to me (and as Don pointed out), is that there is
> > malicious code stored in the database that was entered by users - and is
> > a type of XSS attack.
>
>
>
> Sorry, maybe I used the wrong terms.
> Data entered by users (i.e. people that uses the application) must not be
> evaluated.
> A developer (i.e. a person that maintains the application) can do almost
> anything.
>

I 100% agree on this. I don't see any good reasons for evaluating the
strings entered from the client side of the app.

./alex
--
.w( the_mindstorm )p.

>
> The other option is that a hacker as access to your web app file system
> > and is changing a template.  If this is the case, my personal feeling is
> > that you should be glad they are only changing templates and not doing a
> > number of other things :-)
>
>
>
> This is exactly what the security bulletin addresses. And, personally, I
> hope that those who are using Struts 2/WebWork in their applications do not
> receive much harm...
>
> Antonio
>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org