Mailing-List: contact dev-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Developers List" <dev@struts.apache.org>
Received-SPF: pass (nike.apache.org: domain of steven.benitez@gmail.com
 designates 209.85.160.53 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAMopvkMt8mOSgTovgsPvZT6y2M6W+Ct1UWcdTYTAZffwy-t6Qg@mail.gmail.com>
References: 
 <CAMopvkMt8mOSgTovgsPvZT6y2M6W+Ct1UWcdTYTAZffwy-t6Qg@mail.gmail.com>
Date: Wed, 9 Oct 2013 16:21:51 -0400
Message-ID: 
 <CAPS4wT5T5bE1ZO7yWApiUi1Vybfp5Ajbtb8ZPLgvihSYyyBQ6g@mail.gmail.com>
Subject: Re: Security judges
From: Steven Benitez <steven.benitez@gmail.com>
To: Struts Developers List <dev@struts.apache.org>
Content-Type: multipart/alternative; boundary=001a11343f7eaeaeaa04e854a257

--001a11343f7eaeaeaa04e854a257
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Can you clarify how this would affect custom action mappers?


On Wed, Oct 9, 2013 at 4:05 PM, Lukasz Lenart <lukaszlenart@apache.org>wrot=
e:

> Hi,
>
> Another idea is to add some logic to handle security aspects of the
> framework in one place - it would be some kind of stack of interfaces
> which will try to cleanup incoming request.
>
> For example:
>
> - ActionNameJudge#accept() will handle if action name match expected
> pattern, the same what is already defined with constant in
> DefaultActionMapper
> - ParameterNameJudge#accept() will handle if given parameter name is
> acceptable - the same what ParametersInterceptor do right now
> - etc
>
> The idea is simple - have all the security related logic in one place
> and to have it applied to the whole framework not to some parts, i.e.
> someone will implement their own ActionMapper and won't escape/clear
> action names as it is done in DefaultActionMapper, and so on.
>
> These handlers will be configured in struts-default.xml and user can
> re-define them, additional judges, etc.
>
>
> Regards
> --
> =C5=81ukasz
> + 48 606 323 122 http://www.lenart.org.pl/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
> For additional commands, e-mail: dev-help@struts.apache.org
>
>

--001a11343f7eaeaeaa04e854a257--