2 ms·

...how is this different for complaining that "SQL is unsafe because of injection possibilities"? ...do real world Spring web apps really use unsanitized user

by nnq 14y ago

...how is this different for complaining that "SQL is unsafe because of injection possibilities"? ...do real world Spring web apps really use unsanitized user input with "expression language" queries? (or am I totally missing the point? - not a Spring guy, I admit, but it all reads weird to me)

andrewcooke 14y ago
the point is that spring's el was evaluating things TWICE. if i give my name as "$account.increment" then the worst you would expect to happen is that when my name is displayed it appears as "$account.increment". right? in steps: the jsp page contains <cout value="$user"> el looks at $user and finds the text "$account.increment" and *displays* that. this is completely ok and does not require input sanitization. the code does not appear unsafe. but no - there is the possibility that instead of simply displaying the value, spring will (may - i don't understand exactly when this is triggered) evaluate it. in steps: the jsp page contains <cout value="$user"> el looks at $user and finds the text "$account.increment". el *evaluates* $account.increment and increments the account. PLOP! el displays the result of evaluating the account. again: this occurs when the programmer was only intending to display the value. because spring (by mistake) has a second round of evaluation (first is $user to contents; second is contents to incrementing account), text that should simply be displayed can be evaluated. see, for example https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit?hl=en_US&pli=1 https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghG...
- andrewcooke 14y ago
  an update (edit window is past). it's more complex than i explained above. only a restricted number of tags (spring ones) are affected and you have to be doing fairly stupid things (using user parameters in strange ways). the normal use case of displaying a value is not a risk. sorry.

by nnq 14y ago

andrewcooke 14y ago

the point is that spring's el was evaluating things TWICE. if i give my name as "$account.increment" then the worst you would expect to happen is that when my name is displayed it appears as "$account.increment". right? in steps: the jsp page contains <cout value="$user"> el looks at $user and finds the text "$account.increment" and *displays* that. this is completely ok and does not require input sanitization. the code does not appear unsafe. but no - there is the possibility that instead of simply displaying the value, spring will (may - i don't understand exactly when this is triggered) evaluate it. in steps: the jsp page contains <cout value="$user"> el looks at $user and finds the text "$account.increment". el *evaluates* $account.increment and increments the account. PLOP! el displays the result of evaluating the account. again: this occurs when the programmer was only intending to display the value. because spring (by mistake) has a second round of evaluation (first is $user to contents; second is contents to incrementing account), text that should simply be displayed can be evaluated. see, for example https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghGWm_2Gn0iCrxFsympqcE/edit?hl=en_US&pli=1 https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghG...

andrewcooke 14y ago
an update (edit window is past). it's more complex than i explained above. only a restricted number of tags (spring ones) are affected and you have to be doing fairly stupid things (using user parameters in strange ways). the normal use case of displaying a value is not a risk. sorry.