Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
Received-SPF: pass (athena.apache.org: domain of poulwiel@gmail.com designates
 209.85.215.41 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAMopvkM1SR_udBg93SABm1NLnCivFSA+34btn75mhwf8pY6gXA@mail.gmail.com>
References: 
 <CAN25sNKwj5ef0SzqQ5XkRdFMvioCB9T++huw0FV8kEffBi5=NQ@mail.gmail.com>
	<CAMopvkPxxwDfw4cqonx_t5943YYTDzrMab3mYb-jnxGokeaSJA@mail.gmail.com>
	<CAN25sNKRPEpdsez_XbcmP8XifN-s1nUrOT-1bVMi6tQTC6tZfw@mail.gmail.com>
	<CAMopvkMRk00DGBhP6V6W1hGOvw2t7K2G476DzZMXdOASiaY8qA@mail.gmail.com>
	<CAN25sNKzS7SbtkdHZzBhDuWNs65eq4cEK4qApQpw7=O7PYUoKw@mail.gmail.com>
	<OF0C9C80C0.00F8A245-ONC1257BEF.002DB547-C1257BEF.0030195C@lex-com.net>
	<CAMopvkNAsaUxw3Y=hy7Mbw6U7F6O+19b+K4PPPe9ZCV-hxpcMQ@mail.gmail.com>
	<OF0C4D947E.2F0A6BAE-ONC1257BEF.0031E437-C1257BEF.0031F83C@lex-com.net>
	<52404D82.2020202@abas.de>
	<CA+hYk8YAviSTHJRYDA1kGvMKgM_UJEB2x2joZHQ+Pa03xUh7nQ@mail.gmail.com>
	<CAMopvkM1SR_udBg93SABm1NLnCivFSA+34btn75mhwf8pY6gXA@mail.gmail.com>
Date: Tue, 24 Sep 2013 01:38:03 +0200
Message-ID: 
 <CA+hYk8aB_Fyfqm20cNLW+uPB9H+zKi+fOGcJbgY9dO4wPz-Z_A@mail.gmail.com>
Subject: Re: Url rewriting of .action to .jsp
From: =?ISO-8859-2?Q?Pawe=B3_Wielgus?= <poulwiel@gmail.com>
To: Struts Users Mailing List <user@struts.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi Lukasz,
i see no problem for me in solution described by You.
Off course i'm no security expert here.

Best greetings,
Pawe=C5=82 Wielgus.


2013/9/23 Lukasz Lenart <lukaszlenart@apache.org>:
> 2013/9/23 Pawe=C5=82 Wielgus <poulwiel@gmail.com>:
>> Hi all,
>> I'm using DMI to call "input" method extensively,
>> almost in every Edit*Action.
>> I call it with ParamsPrepareParams stack.
>>
>> I fully understand that allowing DMI is a security problem.
>> But maybe some kind of balance could be achevied.
>> White listing with annotations would not be bad for me
>> also maybe letting call only input (or similar) method by default
>> would not cause to much of a security problem?
>>
>> I'm not saying that i will drop S2
>> if DMI will be disabled,
>> but sure it will make me rewrite all my edit actions.
>
> There is "strict dmi" [1] but I doubt that anybody is using it ;-)
> Anyway, doing some improvement in that area is better than removing
> DMI at all ;-)
> Maybe we should switch to strict dmi by default - e.g "execute, input,
> edit, submit, form" are the only allowed methods to be called via DMI.
> And then remove DMI on/off switch at all (DMI will be always enabled).
>
> [1] http://struts.apache.org/release/2.3.x/docs/action-configuration.html=
#ActionConfiguration-DynamicMethodInvocation
>
>
> Regards
> --
> =C5=81ukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org