[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-2084) (security) EJB-QL injection in org.jboss.seam.framework.Query
Antoni Jakubiak (JIRA)
jira-events at lists.jboss.org
Fri Oct 12 03:30:03 EDT 2007
(security) EJB-QL injection in org.jboss.seam.framework.Query
-------------------------------------------------------------
Key: JBSEAM-2084
URL: http://jira.jboss.com/jira/browse/JBSEAM-2084
Project: JBoss Seam
Issue Type: Bug
Components: Core
Affects Versions: 2.0.0.CR2
Environment: Hibernate, PostgreSQL
Reporter: Antoni Jakubiak
There is a security hole in class: org.jboss.seam.framework.Query in method: getRenderedEjbql(). This method generate EJB-QL query in this way:
if ( getOrder()!=null ) builder.append(" order by ").append( getOrder() );
return builder.toString();
"Order" variable comes from request.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
More information about the seam-issues
mailing list