Mailing-List: contact dev-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Developers List" <dev@struts.apache.org>
Received-SPF: pass (herse.apache.org: domain of musachy@gmail.com designates
 64.233.162.228 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references;
        b=ROAmI4fvr7wiDA+BN8+inWMAq6r++p7033kxtVjV3AtzbP04pAGUUWDiCWF41A3CmvMwq1Hm1v5IRIegkz66PPKsSKwPVYG7ZTVLG2NlImjGahgDVg01Y7A8spCBHTRc0KqXZKiU9qTXdVKFGC22GiSH5MCOJ41U64jLBeY4Bkk=
Message-ID: <d8bdeb6f0707050946q5f5fd963qd7e2bb81fe774c5c@mail.gmail.com>
Date: Thu, 5 Jul 2007 12:46:52 -0400
From: "Musachy Barroso" <musachy@gmail.com>
To: "Struts Developers List" <dev@struts.apache.org>
Subject: Re: [S2] Heads Up: possible DOS problem
In-Reply-To: <d8bdeb6f0707050945u14b3e9d0h8f8eead6d6d64ff3@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_Part_22113_21594454.1183654012131"
References: <aae96ca0707050350i178e3b38o6e37e5762415e6b6@mail.gmail.com>
	 <loom.20070705T135623-315@post.gmane.org>
	 <2BB8416C-6940-4FBE-8E04-BF1E8F41EABB@andreavettori.com>
	 <a74683f90707050847r188e8ebcg4bc1b4faf6a7c2d0@mail.gmail.com>
	 <0E7F46A5-8565-4B52-AF52-6840CCFB4873@andreavettori.com>
	 <d8bdeb6f0707050945u14b3e9d0h8f8eead6d6d64ff3@mail.gmail.com>

------=_Part_22113_21594454.1183654012131
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Implementing ParameterNameAware would solve the problem of someone tampering
the parameter name, but not entering %{} in the value. We need to prevent
both.

musachy

On 7/5/07, Musachy Barroso <musachy@gmail.com> wrote:
>
> Another workaround is to implement ParameterNameAware, and return false
> for parameters like "%{...}". I think that ParametersInterceptor needs to
> check for values like that, just like it does with the names in
> acceptableNames()
>
> musachy
>
> On 7/5/07, Ing. Andrea Vettori <mail@andreavettori.com> wrote:
> >
> > The DoS is because you can trigger an infinite loop.
> >
> > Please take a look at the jira issue.
> >
> > Looks like we need to do different things if the value is specified
> > in the source code or if it's inserted in the field by the user.
> >
> > http://struts.apache.org/2.0.8/docs/tag-syntax.html
> >
> >
> >
> >
> > Il giorno 05/lug/07, alle ore 17:47, Bob Lee ha scritto:
> >
> > > Possible DoS? Isn't this a remote exploit? Can you call arbitrary
> > > methods?
> > >
> > > Bob
> > >
> > > On 7/5/07, Ing. Andrea Vettori <mail@andreavettori.com> wrote:
> > >>
> > >> some simple testing shows that the field value is simply evaluated...
> >
> > >>
> > >> try to put on a struts textfield %{1+1} submit and you'll get "2" on
> > >> the field...
> > >>
> > >> Cool but don't think it should be the default behaviour.
> > >>
> > >> What constructs can trigger recursion ?
> > >>
> > >>
> > >> Il giorno 05/lug/07, alle ore 14:00, Andrea ha scritto:
> > >>
> > >> > Antonio Petrelli <antonio.petrelli <at> gmail.com> writes:
> > >> >
> > >> >>
> > >> >> Hi all,
> > >> >> Andrea Vettori, in the Struts Users mailing list, probably
> > >> discovered
> > >> >> a possible Denial-Of-Service bug in Struts 2.
> > >> >> The cause could be XWork.
> > >> >>
> > >> >
> > >> > Hi,
> > >> >
> > >> > furthermore I'd like to know if there are other "values" that can
> > >> > trigger the
> > >> > problem.
> > >> > Since I don't think that normal users of my site use that kind of
> > >> > password,
> > >> > I'm looking for whatever has triggered the problem about once a day
> >
> > >> > on my
> > >> > e-commerce site...
> > >> >
> > >> > I've tried to follow the source of various classes but it's all new
> > >> > to me so I'm
> > >> > a bit lost.
> > >> >
> > >> > Thanks
> > >> >
> > >> >
> > >> >
> > >> ---------------------------------------------------------------------
> > >> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > >> > For additional commands, e-mail: dev-help@struts.apache.org
> > >> >
> > >>
> > >> --
> > >> Ing. Andrea Vettori
> > >> Consulente per l'Information Technology
> > >>
> > >>
> > >>
> > >> ---------------------------------------------------------------------
> > >> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > >> For additional commands, e-mail: dev-help@struts.apache.org
> > >>
> > >>
> >
> > --
> > Ing. Andrea Vettori
> > Consulente per l'Information Technology
> >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> > For additional commands, e-mail: dev-help@struts.apache.org
> >
> >
>
>
> --
> "Hey you! Would you help me to carry the stone?" Pink Floyd


-- 
"Hey you! Would you help me to carry the stone?" Pink Floyd

------=_Part_22113_21594454.1183654012131--