4 ms·

This is needless scaremongering ! If you write a web application that blindly executes/evals the contents of a request parameter or submitted form data, you ne

This is needless scaremongering ! If you write a web application that blindly executes/evals the contents of a request parameter or submitted form data, you need to have to have your head examined and not blame the underlying framework for security vulnerability. These security experts wrote a JSP page with a intentionally flawed code that passes an incoming request parameter to an expression evaluation engine: <spring:message text="" code="${param['message']}"> </spring:message>. what did you expect will happen? No framework is invulnerable against idiot programmers.

andrewcooke 14y ago
you have misunderstood. the problem (afaict - see link below) is that spring may be evaluating where the programmer intended only to display. see my comment at http://news.ycombinator.com/item?id=5083163 http://news.ycombinator.com/item?id=5083163 the programmer is not evaluating unvalidated text. the programmer is only displaying it. the bug in spring is causing the unexpected, additional evaluation. see, for example, section 3 of https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit?hl=en_US&pli=1 https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghG...
- manishsharan 14y ago
  No I am not mistaken. I have been using this taglib and EL when renedering JSPs. This is how most people use this EL http://stackoverflow.com/questions/10981559/how-to-change-value-of-code-in-springmessage-code http://stackoverflow.com/questions/10981559/how-to-change-va... http://www.coderanch.com/t/489232/Spring/spring-message-tag-labels-java http://www.coderanch.com/t/489232/Spring/spring-message-tag-... See that ? Nobody is using request parameters because that would be fucking stupid. This is a an Expression Evaluation Engine --- it evaluates expressions. Every programmer who uses this knows this. Please stop spreading the FUD!
  - deleted 14y ago
    [deleted]
Anderkent 14y ago
><spring:message text="" code="${param['message']}"> </spring:message>. what did you expect will happen? I expect ${param['message']} to be evaluated to a string, then the string to be used to look up a message. What I don't expect is the string to be evaluated again... Why would I?
- manishsharan 14y ago
  .. because you are feeding it into an evaluation engine. Thats why. If you wanted the expression to be evaluated into a string , then you would use JSP standard way of doing it which is <%=whatever>.

andrewcooke 14y ago

you have misunderstood. the problem (afaict - see link below) is that spring may be evaluating where the programmer intended only to display. see my comment at http://news.ycombinator.com/item?id=5083163 http://news.ycombinator.com/item?id=5083163 the programmer is not evaluating unvalidated text. the programmer is only displaying it. the bug in spring is causing the unexpected, additional evaluation. see, for example, section 3 of https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit?hl=en_US&pli=1 https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghG...

manishsharan 14y ago
No I am not mistaken. I have been using this taglib and EL when renedering JSPs. This is how most people use this EL http://stackoverflow.com/questions/10981559/how-to-change-value-of-code-in-springmessage-code http://stackoverflow.com/questions/10981559/how-to-change-va... http://www.coderanch.com/t/489232/Spring/spring-message-tag-labels-java http://www.coderanch.com/t/489232/Spring/spring-message-tag-... See that ? Nobody is using request parameters because that would be fucking stupid. This is a an Expression Evaluation Engine --- it evaluates expressions. Every programmer who uses this knows this. Please stop spreading the FUD!
- deleted 14y ago
  [deleted]

Anderkent 14y ago

><spring:message text="" code="${param['message']}"> </spring:message>. what did you expect will happen? I expect ${param['message']} to be evaluated to a string, then the string to be used to look up a message. What I don't expect is the string to be evaluated again... Why would I?

manishsharan 14y ago
.. because you are feeding it into an evaluation engine. Thats why. If you wanted the expression to be evaluated into a string , then you would use JSP standard way of doing it which is <%=whatever>.