Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
Received-SPF: pass (athena.apache.org: domain of poulwiel@gmail.com designates
 209.85.215.42 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <52404D82.2020202@abas.de>
References: 
 <CAN25sNKwj5ef0SzqQ5XkRdFMvioCB9T++huw0FV8kEffBi5=NQ@mail.gmail.com>
	<CAMopvkPxxwDfw4cqonx_t5943YYTDzrMab3mYb-jnxGokeaSJA@mail.gmail.com>
	<CAN25sNKRPEpdsez_XbcmP8XifN-s1nUrOT-1bVMi6tQTC6tZfw@mail.gmail.com>
	<CAMopvkMRk00DGBhP6V6W1hGOvw2t7K2G476DzZMXdOASiaY8qA@mail.gmail.com>
	<CAN25sNKzS7SbtkdHZzBhDuWNs65eq4cEK4qApQpw7=O7PYUoKw@mail.gmail.com>
	<OF0C9C80C0.00F8A245-ONC1257BEF.002DB547-C1257BEF.0030195C@lex-com.net>
	<CAMopvkNAsaUxw3Y=hy7Mbw6U7F6O+19b+K4PPPe9ZCV-hxpcMQ@mail.gmail.com>
	<OF0C4D947E.2F0A6BAE-ONC1257BEF.0031E437-C1257BEF.0031F83C@lex-com.net>
	<52404D82.2020202@abas.de>
Date: Mon, 23 Sep 2013 17:42:59 +0200
Message-ID: 
 <CA+hYk8YAviSTHJRYDA1kGvMKgM_UJEB2x2joZHQ+Pa03xUh7nQ@mail.gmail.com>
Subject: Re: Url rewriting of .action to .jsp
From: =?ISO-8859-2?Q?Pawe=B3_Wielgus?= <poulwiel@gmail.com>
To: Struts Users Mailing List <user@struts.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi all,
I'm using DMI to call "input" method extensively,
almost in every Edit*Action.
I call it with ParamsPrepareParams stack.

I fully understand that allowing DMI is a security problem.
But maybe some kind of balance could be achevied.
White listing with annotations would not be bad for me
also maybe letting call only input (or similar) method by default
would not cause to much of a security problem?

I'm not saying that i will drop S2
if DMI will be disabled,
but sure it will make me rewrite all my edit actions.

Best greetings,
Pawe=C5=82 Wielgus.


2013/9/23 Volker Krebs <volker.krebs@abas.de>:
> Am 23.09.2013 11:05, schrieb Christoph Nenning:
>>>
>>>
>>> Just a hint: DMI can be dangerous and we think about removing it.
>>>
>> That would force us to do heavy refactorings in all our applications.
>
>
> Removing DMI completely would break a lot of applications.
> How about white-listing methods ?
>
> At the moment we have a lot of trouble updating all our applications.
> When DMI would be removed, we were forced to drop struts2 and re-implemen=
t.
>
> Greetings
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org