11:06 a.m.
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: http://jira.jboss.com/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assigned To: Darran Lofthouse
Fix For: JBossAS-4.2.3.GA
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:08 a.m.
New subject: [JBoss JIRA] Updated: (JBAS-5657) JSP source code exposure in jmx-console
[ http://jira.jboss.com/jira/browse/JBAS-5657?page=all ]
Clive Saldanha updated JBAS-5657:
---------------------------------
Attachment: JBAS-5657.patch
Fix for this issue.
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: http://jira.jboss.com/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assigned To: Darran Lofthouse
Fix For: JBossAS-4.2.3.GA
Attachments: JBAS-5657.patch
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:10 a.m.
New subject: [JBoss JIRA] Commented: (JBAS-5657) JSP source code exposure in jmx-console
[ http://jira.jboss.com/jira/browse/JBAS-5657?page=comments#action_12418527 ]
Clive Saldanha commented on JBAS-5657:
--------------------------------------
From jsp docs:
The <jsp:useBean> element locates or instantiates a JavaBeans component.
<jsp:useBean> first attempts to locate an instance of the Bean. If the Bean does not
exist, <jsp:useBean> instantiates it from a class or serialized template.
In the patch I check whether it's using an existing Bean from the request scope or if
it has instantiated a new one. If the one from the request scope is null I redirect the
page to the displayMbeans page.
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: http://jira.jboss.com/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assigned To: Darran Lofthouse
Fix For: JBossAS-4.2.3.GA
Attachments: JBAS-5657.patch
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:36 a.m.
New subject: [JBoss JIRA] Updated: (JBAS-5657) JSP source code exposure in jmx-console
[ http://jira.jboss.com/jira/browse/JBAS-5657?page=all ]
Dimitris Andreadis updated JBAS-5657:
-------------------------------------
Fix Version/s: JBossAS-5.0.0.CR1
Looks good; put it in AS trunk, too, thanks.
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: http://jira.jboss.com/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assigned To: Darran Lofthouse
Fix For: JBossAS-4.2.3.GA, JBossAS-5.0.0.CR1
Attachments: JBAS-5657.patch
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11:36 a.m.
New subject: [JBoss JIRA] Assigned: (JBAS-5657) JSP source code exposure in jmx-console
[ http://jira.jboss.com/jira/browse/JBAS-5657?page=all ]
Dimitris Andreadis reassigned JBAS-5657:
----------------------------------------
Assignee: Clive Saldanha (was: Darran Lofthouse)
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: http://jira.jboss.com/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assigned To: Clive Saldanha
Fix For: JBossAS-4.2.3.GA, JBossAS-5.0.0.CR1
Attachments: JBAS-5657.patch
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:43 p.m.
New subject: [JBoss JIRA] Resolved: (JBAS-5657) JSP source code exposure in jmx-console
[ http://jira.jboss.com/jira/browse/JBAS-5657?page=all ]
Clive Saldanha resolved JBAS-5657.
----------------------------------
Resolution: Done
Applied patches to Branch_4_2 and trunk
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: http://jira.jboss.com/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assigned To: Clive Saldanha
Fix For: JBossAS-5.0.0.CR1, JBossAS-4.2.3.GA
Attachments: JBAS-5657.patch
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
3:56 a.m.
New subject: [JBoss JIRA] Closed: (JBAS-5657) JSP source code exposure in jmx-console
[ http://jira.jboss.com/jira/browse/JBAS-5657?page=all ]
Dimitris Andreadis closed JBAS-5657.
------------------------------------
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: http://jira.jboss.com/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assigned To: Clive Saldanha
Fix For: JBossAS-4.2.3.GA, JBossAS-5.0.0.CR1
Attachments: JBAS-5657.patch
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:55 p.m.
New subject: [JBoss JIRA] Commented: (JBAS-5657) JSP source code exposure in jmx-console
[
https://jira.jboss.org/jira/browse/JBAS-5657?page=com.atlassian.jira.plug...
]
Farah Juma commented on JBAS-5657:
----------------------------------
I have applied simpleErrorPage.patch (see JBPAPP-529) to AS trunk:
I created a generic error page for the JMX console that gets displayed whenever HTTP
Status 500 exceptions occur. The error page does not expose the details of the error.
JSP source code exposure in jmx-console
---------------------------------------
Key: JBAS-5657
URL: https://jira.jboss.org/jira/browse/JBAS-5657
Project: JBoss Application Server
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: JMX/Web Console
Affects Versions: JBossAS-4.2.2.GA
Reporter: Clive Saldanha
Assignee: Clive Saldanha
Fix For: JBossAS-5.0.0.CR1, JBossAS-4.2.3.GA
Attachments: JBAS-5657.patch
The error page of the jmx-console spits out JSP source code.
http://127.0.0.1:8080/jmx-console/DisplayOpResult
HTTP Status 500 -
type Exception report
message
description The server encountered an internal error () that prevented it from fulfilling
this request.
exception
org.apache.jasper.JasperException: An exception occurred processing JSP page
/displayOpResult.jsp at line 12
9: </head>
10: <body>
11:
12: <jsp:useBean id='opResultInfo'
type='org.jboss.jmx.adaptor.control.OpResultInfo' scope='request'/>
13:
14: <table width="100%">
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5702
days inactive
5838
days old
7 comments
3 participants
participants (3)
-
Clive Saldanha (JIRA) -
Dimitris Andreadis (JIRA)
-
Farah Juma (JIRA)