struts-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (WW-4620) ParametersInterceptor should check collection index to against DOS
Date Mon, 27 Jun 2016 00:51:52 GMT

    [ https://issues.apache.org/jira/browse/WW-4620?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15350315#comment-15350315
] 

ASF GitHub Bot commented on WW-4620:
------------------------------------

GitHub user victorsosa opened a pull request:

    https://github.com/apache/struts/pull/104

    WW-4620 ParametersInterceptor should check collection index to against DOS

    ParametersInterceptor should check collection index to against DOS
    
    Check the parameters map to have only 255 objects to avoid DOS.
    
    https://dzone.com/articles/spring-initbinder-for-handling-large-list-of-java

You can merge this pull request into a Git repository by running:

    $ git pull https://github.com/victorsosa/struts WW-4620

Alternatively you can review and apply these changes as the patch at:

    https://github.com/apache/struts/pull/104.patch

To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:

    This closes #104
    
----
commit d93bcf9ff5c643cd3c64074085dc81ba6785385a
Author: victorsosa <victor.sosa@peopleware.do>
Date:   2016-06-26T23:01:43Z

    WW-4620
    ParametersInterceptor should check collection index to against DOS

commit cacb3a62c6f3efa416e30a85a3a5a320cb63d6b3
Author: victorsosa <victor.sosa@peopleware.do>
Date:   2016-06-26T23:27:17Z

    small fix set parameter AutoGrowCollectionLimit

commit 31a788d7b19fe8a7e4ee16bcc2f42111baeed93b
Author: victorsosa <victor.sosa@peopleware.do>
Date:   2016-06-27T00:36:01Z

    add test cases

----


> ParametersInterceptor should check collection index to against DOS
> ------------------------------------------------------------------
>
>                 Key: WW-4620
>                 URL: https://issues.apache.org/jira/browse/WW-4620
>             Project: Struts 2
>          Issue Type: Improvement
>          Components: Core Interceptors
>            Reporter: zhouyanming
>            Priority: Critical
>             Fix For: 2.3.30, 2.5.2
>
>
> https://dzone.com/articles/spring-initbinder-for-handling-large-list-of-java
> This is my workaround:
> {code:java}
> import org.apache.commons.lang3.StringUtils;
> import com.opensymphony.xwork2.interceptor.ParametersInterceptor;
> import com.opensymphony.xwork2.util.logging.Logger;
> import com.opensymphony.xwork2.util.logging.LoggerFactory;
> public class ParamsInterceptor extends ParametersInterceptor {
> 	private static final Logger LOG = LoggerFactory.getLogger(ParametersInterceptor.class);
> 	protected int autoGrowCollectionLimit = 255;
> 	public void setAutoGrowCollectionLimit(int autoGrowCollectionLimit) {
> 		this.autoGrowCollectionLimit = autoGrowCollectionLimit;
> 	}
> 	@Override
> 	protected boolean acceptableName(String name) {
> 		boolean b = super.acceptableName(name);
> 		if (b) {
> 			int start = name.indexOf('[');
> 			while (start > 0) {
> 				int end = name.indexOf(']', start);
> 				if (end < 0)
> 					break;
> 				String s = name.substring(start + 1, end);
> 				if (StringUtils.isNumeric(s)) {
> 					int index = Integer.valueOf(s);
> 					if (index > autoGrowCollectionLimit) {
> 						LOG.warn("Parameter \"#0\" exceed max index: [#1]", name, autoGrowCollectionLimit);
> 						return false;
> 					}
> 				}
> 				start = name.indexOf('[', end);
> 			}
> 		}
> 		return b;
> 	}
> }
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message