Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
MIME-Version: 1.0
In-Reply-To: 
 <CAG_=iacYdOQnNfMXY-zzEH7rtjG78JD2j0=bUoVNESJeTsULaw@mail.gmail.com>
References: 
 <CAG_=iacYdOQnNfMXY-zzEH7rtjG78JD2j0=bUoVNESJeTsULaw@mail.gmail.com>
Date: Wed, 4 Jul 2012 14:57:41 +0200
Message-ID: 
 <CAMopvkMAsnP0y6JSPXOWM_xctK43CLNb0wYv9ht4G0BcmBAWkg@mail.gmail.com>
Subject: Re: data injection attack
From: Lukasz Lenart <lukaszlenart@apache.org>
To: Struts Users Mailing List <user@struts.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

By removing setter for it ?


Regards

--=20
=C5=81ukasz
+ 48 606 323 122 http://www.lenart.org.pl/


2012/7/4 J. Garcia <jogaco.en@gmail.com>:
> An interesting article that I found:
>
> http://websec.wordpress.com/2012/01/04/multiple-vulnerabilities-in-apache=
-struts2-and-property-oriented-programming-with-java/
>
> In struts2 it is pretty easy to set attribute values of any bean field wh=
en
> a form is posted, even if the field is not in the form.
> For instance, in my struts2 jsp form I have fields such as:
>  - mybean.id, hidden
>  - mybean.field1,
>  - mybean.field2
>
> With Firebug, I can easily add a mybean.field3 and set it to any value wh=
en
> the form is posted.
>
> I've seen that Spring MVC has the concept of allowed fields to prevent da=
ta
> injection attack. How can this be done in Struts2?
>
> J.

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org