Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
Received-SPF: pass (athena.apache.org: domain of dale@newfield.org designates
 209.85.128.178 as permitted sender)
Subject: Re: Apple sec breach.. Struts?
References: 
 <CAOeeQypBkf5+r0s-sT-tJW70AyPxZxw=Q-vRaRnVOqXM+yDhzg@mail.gmail.com>
 <CAPFNckiZqqJ69TW7mvMb3RjhZzQGPLbfMC+xY=3ntYtqLXBMuQ@mail.gmail.com>
 <CADJJoV5=6Vt8odAT=ibUoVupzv1Z6pg-ceSVJdF-NvYZObxzzA@mail.gmail.com>
From: Dale Newfield <dale@newfield.org>
Content-Type: text/plain;
	charset=us-ascii
In-Reply-To: 
 <CADJJoV5=6Vt8odAT=ibUoVupzv1Z6pg-ceSVJdF-NvYZObxzzA@mail.gmail.com>
Message-Id: <890BA252-EAC9-4BD2-A645-CC0804432CC3@Newfield.org>
Date: Wed, 31 Jul 2013 09:33:20 -0400
To: Struts Users Mailing List <user@struts.apache.org>
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (1.0)

On Jul 31, 2013, at 9:25 AM, Dave Newton <davelnewton@gmail.com> wrote:
> I'm not convinced OGNL itself is the issue, but
> rather its unfettered access into internals. An intermediate, sandbox-y
> layer might resolve that.

It's only partially what data ognl can fetch/modify, it's also what it can d=
o.  System.exit() is clearly something undesirable to execute unexpectedly (=
although probably less harmful than other actions).

-Dale=

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org