Return-Path: 
 <issues-return-21400-apmail-struts-issues-archive=struts.apache.org@struts.apache.org>
X-Original-To: apmail-struts-issues-archive@minotaur.apache.org
Delivered-To: apmail-struts-issues-archive@minotaur.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id D0F37C69E
	for <apmail-struts-issues-archive@minotaur.apache.org>;
 Sat,  6 Jul 2013 19:05:48 +0000 (UTC)
Received: (qmail 97185 invoked by uid 500); 6 Jul 2013 19:05:48 -0000
Delivered-To: apmail-struts-issues-archive@struts.apache.org
Received: (qmail 97160 invoked by uid 500); 6 Jul 2013 19:05:48 -0000
Mailing-List: contact issues-help@struts.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:issues-help@struts.apache.org>
List-Unsubscribe: <mailto:issues-unsubscribe@struts.apache.org>
List-Post: <mailto:issues@struts.apache.org>
List-Id: <issues.struts.apache.org>
Reply-To: dev@struts.apache.org
Delivered-To: mailing list issues@struts.apache.org
Received: (qmail 97153 invoked by uid 99); 6 Jul 2013 19:05:48 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 06 Jul 2013 19:05:48 +0000
Date: Sat, 6 Jul 2013 19:05:48 +0000 (UTC)
From: "ASF subversion and git services (JIRA)" <jira@apache.org>
To: issues@struts.apache.org
Message-ID: <JIRA.12606260.1346859760788.7685.1373137548579@arcas>
In-Reply-To: <JIRA.12606260.1346859760788@arcas>
References: <JIRA.12606260.1346859760788@arcas>
Subject: [jira] [Commented] (WW-3873) file tag leaks server path information
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/WW-3873?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13701389#comment-13701389 ] 

ASF subversion and git services commented on WW-3873:
-----------------------------------------------------

Commit 1500313 from [~rgielen]
[ https://svn.apache.org/r1500313 ]

Merged from STRUTS_2_3_15_X
WW-3873 file tag leaks server path information
- file-tag: disabled rendering of any content within value attribute [from revision 1500311]
                
> file tag leaks server path information
> --------------------------------------
>
>                 Key: WW-3873
>                 URL: https://issues.apache.org/jira/browse/WW-3873
>             Project: Struts 2
>          Issue Type: Bug
>    Affects Versions: 2.3.4, 2.3.4.1
>         Environment: Linux, weblogic 10-12, tomcat 7
>            Reporter: Cam Morris
>            Assignee: Rene Gielen
>            Priority: Minor
>             Fix For: 2.3.16
>
>         Attachments: file-leak.png
>
>
> After a fileupload action, if the result jsp contains a <s:file> tag the value attribute is filled in with the server path where the file was saved.  This discloses file system information about the server.
> To duplicate: 
> 1) setup the struts2_showcase sample app
> 2) change struts-fileupload.xml from this
> {code}
>         <action name="doUpload" class="org.apache.struts2.showcase.fileupload.FileUploadAction" method="upload">
>         	<result name="input">upload.jsp</result>
> 			<result>upload-success.jsp</result>
> 		</action>
> {code}
>  to this
> {code}
>         <action name="doUpload" class="org.apache.struts2.showcase.fileupload.FileUploadAction" method="upload">
>         	<result name="input">upload.jsp</result>
> 			<result>upload.jsp</result>
> 		</action>
> {code}
> 3. Deploy & Upload file using the url struts2-showcase/fileupload/upload.action
> 4. View source, in the input tag generated by the s:file tag you'll see the full path to the file that was uploaded.
> {code}
> <input type="file" name="upload" value="/home/cmorris/Workspace/struts2-examples/.metadata/.plugins/org.eclipse.wst.server.core/tmp0/work/Catalina/localhost/struts2-showcase/upload__1bd5a0ad_13997105f96__8000_00000002.tmp" id="doUpload_upload"/>
> {code}
> 		
> Workaround:
> A workaround is simple, just add an empty value attribute to the file tag:
> {code}
> <s:file name="upload" label="File" value=""/>
> {code}

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira