<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word"><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3243" name=GENERATOR>
<STYLE>@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
P.MsoPlainText {
FONT-SIZE: 10pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Courier New"
}
LI.MsoPlainText {
FONT-SIZE: 10pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Courier New"
}
DIV.MsoPlainText {
FONT-SIZE: 10pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Courier New"
}
SPAN.EmailStyle17 {
COLOR: windowtext; FONT-FAMILY: Arial; mso-style-type: personal-compose
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-US vLink=purple link=blue>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN class=496341921-29022008>I got a request today to
verify that the Drools JBRMS is not vulnerable to "JavaScript Hijacking" - a
term coined by Fortify Software in an article in March 2007 where they note that
GWT is vulnerable to JavaScript Hijacking if some default behaviors are changed.
</SPAN></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN
class=496341921-29022008></SPAN></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN class=496341921-29022008>Based on the research I've
done so far, I don't think this is the case, but am posting to the list to see
if someone more knowledgeable on the JBRMS than myself (wouldn't take much) has
considered this issue.</SPAN></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN
class=496341921-29022008></SPAN></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN class=496341921-29022008>Here's why I don't think the
JBRMS is vulnerable:</SPAN></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN
class=496341921-29022008></SPAN></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN class=496341921-29022008>1. The Fortify
Software article says you need to use HTTP GET requests to be vulnerable.
GWT's default behavior is to use HTTP POST requests, and I only found POST
requests in the GWT-compiler-generated HTML files for version
4.0.4.</SPAN></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN
class=496341921-29022008></SPAN></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000><SPAN class=496341921-29022008><FONT size=2>2. The Fortify
Software article says you can be vulnerable if you use JSON. I don't see
any instances of JSON in the JBRMS source code - as best as I
can tell from Google's GWT documentation, you would use their
JSONParser class if you were doing this(</FONT><A
href="http://groups.google.com/group/Google-Web-Toolkit/web/security-for-gwt-applications"><FONT
size=2>http://groups.google.com/group/Google-Web-Toolkit/web/security-for-gwt-applications</FONT></A><FONT
size=2>).</FONT></SPAN></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN
class=496341921-29022008></SPAN></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2><SPAN class=496341921-29022008>I'm posting to the list
because I didn't see any drools-jbrms JIRA issues regarding
security.</SPAN></FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><FONT face="Courier New"
color=#000000 size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><SPAN
class=496341921-29022008><FONT face="Courier New" color=#000000
size=2>Thanks,</FONT></SPAN></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=654214919-29022008><SPAN
class=496341921-29022008><FONT face="Courier New" color=#000000 size=2>Dave
Warren</FONT></SPAN></SPAN></DIV></FONT></DIV></BODY></HTML>