Re: Struts2 Bean Setter Attack

2009-06-30 Thread Dave Newton
Martin Gainty wrote: possibly excludeParams with (reg-exp) patterns to exclude > ,^struts\..* > It's probably unusual to have variables named "". Dave - To unsubscribe, e-mail: user-unsubscr...@struts.apache.or

RE: Struts2 Bean Setter Attack

2009-06-30 Thread Martin Gainty
rmation seulement et n'aura pas n'importe quel effet légalement obligatoire. Étant donné que les email peuvent facilement être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité pour le contenu fourni. > Date: Tue, 30 Jun 2009 16:54:08 -0700 > Subject: R

Re: Struts2 Bean Setter Attack

2009-06-30 Thread Musachy Barroso
There are around 25.8 ways to prevent this, some options are to block it in the params interceptor config, to configure the remove parameters interceptor, to implement ParameterNameAware and filter out evil parameters. musachy On Tue, Jun 30, 2009 at 3:40 PM, smart acer wrote: > We need an object

Re: Struts2 Bean Setter Attack

2009-06-30 Thread Jim Kiley
Why worry if an object at your view layer gets a value set on it? Your real processing should be occurring at a service layer underneath the view layer. Only copy data from the view down into your application if you really need for it to be copied down. jk On Tue, Jun 30, 2009 at 6:40 PM, smart

Struts2 Bean Setter Attack

2009-06-30 Thread smart acer
We need an object for example CustomerData in session. We have configured it through struts2 xml, session scope. Base Action class has a getter and setter for this bean. getCustomerData(), setCustomerData() Since it has a setter on action class (setter is needed to put it on session thru struts2)