struts-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Lukasz Lenart (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (WW-3668) Vulnerability: User input is evaluated as an OGNL expression when there's a conversion error.
Date Tue, 09 Aug 2011 07:52:29 GMT

    [ https://issues.apache.org/jira/browse/WW-3668?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13081496#comment-13081496
] 

Lukasz Lenart commented on WW-3668:
-----------------------------------

I've checked the classes and lines you pointed out but they're the same right now as you proposed
or did I misunderstand your suggestion and it isn't a fix ?

> Vulnerability: User input is evaluated as an OGNL expression when there's a conversion
error.
> ---------------------------------------------------------------------------------------------
>
>                 Key: WW-3668
>                 URL: https://issues.apache.org/jira/browse/WW-3668
>             Project: Struts 2
>          Issue Type: Bug
>          Components: Core Interceptors
>    Affects Versions: 2.2.3
>         Environment: Struts 2.2.3
> Tomcat 7.0.19
>            Reporter: Hideyuki Suzumi
>
> 1. Run "Struts Showcase".
> 2. Click "Validation".
> 3. Click "Field Validators".
> 4. Type "<' + #application + '>" in the "Integer Validator Field".
> 5. Click "Submit".
> 6. You can get all "application" scoped variables in the "Integer Validator Field".
> Please fix ConversionErrorInterceptor and RepopulateConversionErrorFieldValidatorSupport.
> com.opensymphony.xwork2.interceptor.ConversionErrorInterceptor
> 87:        return "'" + value + "'";
> com.opensymphony.xwork2.validator.validators.RepopulateConversionErrorFieldValidatorSupport
> 175:                    fakeParams.put(fullFieldName, "'" + tmpValue[0] + "'");
> 182:                fakeParams.put(fullFieldName, "'" + tmpValue + "'");

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira

        

Mime
View raw message