[jboss-jira] [JBoss JIRA] Commented: (JBAS-5657) JSP source code exposure in jmx-console
[ http://jira.jboss.com/jira/browse/JBAS-5657?page=comments#action_12418527 ]
Clive Saldanha commented on JBAS-5657:
--------------------------------------
From jsp docs:
The <jsp:useBean> element locates or instantiates a JavaBeans component.
<jsp:useBean> first attempts to locate an instance of the Bean. If the Bean does not
exist, <jsp:useBean> instantiates it from a class or serialized template.
In the patch I check whether it's using an existing Bean from the request scope or if
it has instantiated a new one. If the one from the request scope is null I redirect the
page to the displayMbeans page.
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: http://jira.jboss.com/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assigned To: Darran Lofthouse
Fix For: JBossAS-4.2.3.GA
Attachments: JBAS-5657.patch
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira