Return-Path: X-Original-To: apmail-struts-issues-archive@minotaur.apache.org Delivered-To: apmail-struts-issues-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id D5D8AF761 for ; Fri, 5 Jul 2013 15:19:50 +0000 (UTC) Received: (qmail 66492 invoked by uid 500); 5 Jul 2013 15:19:49 -0000 Delivered-To: apmail-struts-issues-archive@struts.apache.org Received: (qmail 66441 invoked by uid 500); 5 Jul 2013 15:19:49 -0000 Mailing-List: contact issues-help@struts.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@struts.apache.org Delivered-To: mailing list issues@struts.apache.org Received: (qmail 66413 invoked by uid 99); 5 Jul 2013 15:19:48 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 05 Jul 2013 15:19:48 +0000 Date: Fri, 5 Jul 2013 15:19:48 +0000 (UTC) From: "Rene Gielen (JIRA)" To: issues@struts.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Issue Comment Deleted] (WW-3873) file tag leaks server path information MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/WW-3873?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Rene Gielen updated WW-3873: ---------------------------- Comment: was deleted (was: I will be out of the office until July 5th On Jul 5, 2013, at 7:32 AM, "Nathan.Comstock@wellsfargo.com (JIRA)" wrote: [ https://issues.apache.org/jira/browse/WW-3873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13700844#comment-13700844 ] Nathan.Comstock@wellsfargo.com commented on WW-3873: ---------------------------------------------------- I will be out of the office until July 5th On Jul 5, 2013, at 7:28 AM, "Nathan.Comstock@wellsfargo.com (JIRA)" wrote: [ https://issues.apache.org/jira/browse/WW-3873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13700810#comment-13700810 ] Nathan.Comstock@wellsfargo.com commented on WW-3873: ---------------------------------------------------- I will be out of the office until July 5th On Jul 5, 2013, at 7:24 AM, "Nathan.Comstock@wellsfargo.com (JIRA)" wrote: [ https://issues.apache.org/jira/browse/WW-3873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13700773#comment-13700773 ] Nathan.Comstock@wellsfargo.com commented on WW-3873: ---------------------------------------------------- I will be out of the office until July 5th On Jul 5, 2013, at 7:21 AM, "Nathan.Comstock@wellsfargo.com (JIRA)" wrote: [ https://issues.apache.org/jira/browse/WW-3873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13700729#comment-13700729 ] Nathan.Comstock@wellsfargo.com commented on WW-3873: ---------------------------------------------------- I will be out of the office until July 5th On Jul 5, 2013, at 1:29 AM, "Rene Gielen (JIRA)" wrote: [ https://issues.apache.org/jira/browse/WW-3873?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Rene Gielen updated WW-3873: ---------------------------- Assignee: Rene Gielen file tag leaks server path information -------------------------------------- Key: WW-3873 URL: https://issues.apache.org/jira/browse/WW-3873 Project: Struts 2 Issue Type: Bug Affects Versions: 2.3.4, 2.3.4.1 Environment: Linux, weblogic 10-12, tomcat 7 Reporter: Cam Morris Assignee: Rene Gielen Priority: Minor Fix For: 2.3.16 Attachments: file-leak.png After a fileupload action, if the result jsp contains a tag the value attribute is filled in with the server path where the file was saved. This discloses file system information about the server. To duplicate: 1) setup the struts2_showcase sample app 2) change struts-fileupload.xml from this {code} upload.jsp upload-success.jsp {code} to this {code} upload.jsp upload.jsp {code} 3. Deploy & Upload file using the url struts2-showcase/fileupload/upload.action 4. View source, in the input tag generated by the s:file tag you'll see the full path to the file that was uploaded. {code} {code} Workaround: A workaround is simple, just add an empty value attribute to the file tag: {code} {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira file tag leaks server path information -------------------------------------- Key: WW-3873 URL: https://issues.apache.org/jira/browse/WW-3873 Project: Struts 2 Issue Type: Bug Affects Versions: 2.3.4, 2.3.4.1 Environment: Linux, weblogic 10-12, tomcat 7 Reporter: Cam Morris Assignee: Rene Gielen Priority: Minor Fix For: 2.3.16 Attachments: file-leak.png After a fileupload action, if the result jsp contains a tag the value attribute is filled in with the server path where the file was saved. This discloses file system information about the server. To duplicate: 1) setup the struts2_showcase sample app 2) change struts-fileupload.xml from this {code} upload.jsp upload-success.jsp {code} to this {code} upload.jsp upload.jsp {code} 3. Deploy & Upload file using the url struts2-showcase/fileupload/upload.action 4. View source, in the input tag generated by the s:file tag you'll see the full path to the file that was uploaded. {code} {code} Workaround: A workaround is simple, just add an empty value attribute to the file tag: {code} {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira file tag leaks server path information -------------------------------------- Key: WW-3873 URL: https://issues.apache.org/jira/browse/WW-3873 Project: Struts 2 Issue Type: Bug Affects Versions: 2.3.4, 2.3.4.1 Environment: Linux, weblogic 10-12, tomcat 7 Reporter: Cam Morris Assignee: Rene Gielen Priority: Minor Fix For: 2.3.16 Attachments: file-leak.png After a fileupload action, if the result jsp contains a tag the value attribute is filled in with the server path where the file was saved. This discloses file system information about the server. To duplicate: 1) setup the struts2_showcase sample app 2) change struts-fileupload.xml from this {code} upload.jsp upload-success.jsp {code} to this {code} upload.jsp upload.jsp {code} 3. Deploy & Upload file using the url struts2-showcase/fileupload/upload.action 4. View source, in the input tag generated by the s:file tag you'll see the full path to the file that was uploaded. {code} {code} Workaround: A workaround is simple, just add an empty value attribute to the file tag: {code} {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira file tag leaks server path information -------------------------------------- Key: WW-3873 URL: https://issues.apache.org/jira/browse/WW-3873 Project: Struts 2 Issue Type: Bug Affects Versions: 2.3.4, 2.3.4.1 Environment: Linux, weblogic 10-12, tomcat 7 Reporter: Cam Morris Assignee: Rene Gielen Priority: Minor Fix For: 2.3.16 Attachments: file-leak.png After a fileupload action, if the result jsp contains a tag the value attribute is filled in with the server path where the file was saved. This discloses file system information about the server. To duplicate: 1) setup the struts2_showcase sample app 2) change struts-fileupload.xml from this {code} upload.jsp upload-success.jsp {code} to this {code} upload.jsp upload.jsp {code} 3. Deploy & Upload file using the url struts2-showcase/fileupload/upload.action 4. View source, in the input tag generated by the s:file tag you'll see the full path to the file that was uploaded. {code} {code} Workaround: A workaround is simple, just add an empty value attribute to the file tag: {code} {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira file tag leaks server path information -------------------------------------- Key: WW-3873 URL: https://issues.apache.org/jira/browse/WW-3873 Project: Struts 2 Issue Type: Bug Affects Versions: 2.3.4, 2.3.4.1 Environment: Linux, weblogic 10-12, tomcat 7 Reporter: Cam Morris Assignee: Rene Gielen Priority: Minor Fix For: 2.3.16 Attachments: file-leak.png After a fileupload action, if the result jsp contains a tag the value attribute is filled in with the server path where the file was saved. This discloses file system information about the server. To duplicate: 1) setup the struts2_showcase sample app 2) change struts-fileupload.xml from this {code} upload.jsp upload-success.jsp {code} to this {code} upload.jsp upload.jsp {code} 3. Deploy & Upload file using the url struts2-showcase/fileupload/upload.action 4. View source, in the input tag generated by the s:file tag you'll see the full path to the file that was uploaded. {code} {code} Workaround: A workaround is simple, just add an empty value attribute to the file tag: {code} {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira ) > file tag leaks server path information > -------------------------------------- > > Key: WW-3873 > URL: https://issues.apache.org/jira/browse/WW-3873 > Project: Struts 2 > Issue Type: Bug > Affects Versions: 2.3.4, 2.3.4.1 > Environment: Linux, weblogic 10-12, tomcat 7 > Reporter: Cam Morris > Assignee: Rene Gielen > Priority: Minor > Fix For: 2.3.16 > > Attachments: file-leak.png > > > After a fileupload action, if the result jsp contains a tag the value attribute is filled in with the server path where the file was saved. This discloses file system information about the server. > To duplicate: > 1) setup the struts2_showcase sample app > 2) change struts-fileupload.xml from this > {code} > > upload.jsp > upload-success.jsp > > {code} > to this > {code} > > upload.jsp > upload.jsp > > {code} > 3. Deploy & Upload file using the url struts2-showcase/fileupload/upload.action > 4. View source, in the input tag generated by the s:file tag you'll see the full path to the file that was uploaded. > {code} > > {code} > > Workaround: > A workaround is simple, just add an empty value attribute to the file tag: > {code} > > {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira