11:57 p.m.
hidden field javax.faces.ViewState is not sanitized
---------------------------------------------------
Key: RF-1518
URL: http://jira.jboss.com/jira/browse/RF-1518
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.1.2
Environment: jsf-ri 1.2_06-b02-FCS, facelets 1.1.13, RichFaces 3.1.2SP1,
WindowsXP(x86_64)
Reporter: Tomoharu Fujita
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made like this Post Request
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html
xmlns="http://www.w3.org/1999/xhtml"><head><title&g...
<link type="text/css" rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" />
<script type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script>
</head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
But I'm not sure it's jsf-ri issue or richfaces.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
2:17 a.m.
New subject: [JBoss JIRA] Updated: (RF-1518) hidden field javax.faces.ViewState is not sanitized
[ http://jira.jboss.com/jira/browse/RF-1518?page=all ]
Tomoharu Fujita updated RF-1518:
--------------------------------
Description:
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made a Post Request like below
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
I'm not sure it's jsf-ri issue or richfaces, but if
javax.faces.STATE_SAVING_METHOD set to client,
I couldn't reproduce the same issue.
was:
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made like this Post Request
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html
xmlns="http://www.w3.org/1999/xhtml"><head><title&g...
<link type="text/css" rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" />
<script type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script>
</head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
But I'm not sure it's jsf-ri issue or richfaces.
hidden field javax.faces.ViewState is not sanitized
---------------------------------------------------
Key: RF-1518
URL: http://jira.jboss.com/jira/browse/RF-1518
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.1.2
Environment: jsf-ri 1.2_06-b02-FCS, facelets 1.1.13, RichFaces 3.1.2SP1,
WindowsXP(x86_64)
Reporter: Tomoharu Fujita
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made a Post Request like below
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
I'm not sure it's jsf-ri issue or richfaces, but if
javax.faces.STATE_SAVING_METHOD set to client,
I couldn't reproduce the same issue.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:33 a.m.
New subject: [JBoss JIRA] Updated: (RF-1518) hidden field javax.faces.ViewState is not sanitized
[ http://jira.jboss.com/jira/browse/RF-1518?page=all ]
Nick Belaevski updated RF-1518:
-------------------------------
Fix Version/s: 3.2.0
Assignee: Anton Belevich
hidden field javax.faces.ViewState is not sanitized
---------------------------------------------------
Key: RF-1518
URL: http://jira.jboss.com/jira/browse/RF-1518
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.1.2
Environment: jsf-ri 1.2_06-b02-FCS, facelets 1.1.13, RichFaces 3.1.2SP1,
WindowsXP(x86_64)
Reporter: Tomoharu Fujita
Assigned To: Anton Belevich
Fix For: 3.2.0
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made a Post Request like below
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
I'm not sure it's jsf-ri issue or richfaces, but if
javax.faces.STATE_SAVING_METHOD set to client,
I couldn't reproduce the same issue.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:21 a.m.
New subject: [JBoss JIRA] Commented: (RF-1518) hidden field javax.faces.ViewState is not sanitized
[ http://jira.jboss.com/jira/browse/RF-1518?page=comments#action_12391048 ]
Anton Belevich commented on RF-1518:
------------------------------------
I don't see this script: alert(document.cookie); in response.
hidden field javax.faces.ViewState is not sanitized
---------------------------------------------------
Key: RF-1518
URL: http://jira.jboss.com/jira/browse/RF-1518
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.1.2
Environment: jsf-ri 1.2_06-b02-FCS, facelets 1.1.13, RichFaces 3.1.2SP1,
WindowsXP(x86_64)
Reporter: Tomoharu Fujita
Assigned To: Anton Belevich
Fix For: 3.2.0
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made a Post Request like below
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
I'm not sure it's jsf-ri issue or richfaces, but if
javax.faces.STATE_SAVING_METHOD set to client,
I couldn't reproduce the same issue.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:52 a.m.
New subject: [JBoss JIRA] Resolved: (RF-1518) hidden field javax.faces.ViewState is not sanitized
[ http://jira.jboss.com/jira/browse/RF-1518?page=all ]
Anton Belevich resolved RF-1518.
--------------------------------
Resolution: Cannot Reproduce Bug
hidden field javax.faces.ViewState is not sanitized
---------------------------------------------------
Key: RF-1518
URL: http://jira.jboss.com/jira/browse/RF-1518
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.1.2
Environment: jsf-ri 1.2_06-b02-FCS, facelets 1.1.13, RichFaces 3.1.2SP1,
WindowsXP(x86_64)
Reporter: Tomoharu Fujita
Assigned To: Anton Belevich
Fix For: 3.2.0
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made a Post Request like below
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
I'm not sure it's jsf-ri issue or richfaces, but if
javax.faces.STATE_SAVING_METHOD set to client,
I couldn't reproduce the same issue.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
5:48 a.m.
New subject: [JBoss JIRA] Assigned: (RF-1518) hidden field javax.faces.ViewState is not sanitized
[ http://jira.jboss.com/jira/browse/RF-1518?page=all ]
Tsikhon Kuprevich reassigned RF-1518:
-------------------------------------
Assignee: Viktor Volkov (was: Anton Belevich)
hidden field javax.faces.ViewState is not sanitized
---------------------------------------------------
Key: RF-1518
URL: http://jira.jboss.com/jira/browse/RF-1518
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.1.2
Environment: jsf-ri 1.2_06-b02-FCS, facelets 1.1.13, RichFaces 3.1.2SP1,
WindowsXP(x86_64)
Reporter: Tomoharu Fujita
Assigned To: Viktor Volkov
Fix For: 3.2.0
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made a Post Request like below
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
I'm not sure it's jsf-ri issue or richfaces, but if
javax.faces.STATE_SAVING_METHOD set to client,
I couldn't reproduce the same issue.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
9:19 a.m.
New subject: [JBoss JIRA] Closed: (RF-1518) hidden field javax.faces.ViewState is not sanitized
[ http://jira.jboss.com/jira/browse/RF-1518?page=all ]
Viktor Volkov closed RF-1518.
-----------------------------
hidden field javax.faces.ViewState is not sanitized
---------------------------------------------------
Key: RF-1518
URL: http://jira.jboss.com/jira/browse/RF-1518
Project: RichFaces
Issue Type: Bug
Affects Versions: 3.1.2
Environment: jsf-ri 1.2_06-b02-FCS, facelets 1.1.13, RichFaces 3.1.2SP1,
WindowsXP(x86_64)
Reporter: Tomoharu Fujita
Assigned To: Viktor Volkov
Fix For: 3.2.0
Here is the sample facelets page in my application that produces the symptom.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns:f="http://java.sun.com/jsf/core"
xmlns:h="http://java.sun.com/jsf/html"
xmlns:ui="http://java.sun.com/jsf/facelets"
xmlns:a4j="http://richfaces.org/a4j"
xmlns:rich="http://richfaces.org/rich"
xmlns="http://www.w3.org/1999/xhtml" >
<head>
<title></title>
</head>
<body>
<f:view>
<h:form>
<rich:panel header="Simple Echo">
<h:inputText size="20"
value="#{startupBean.command}" >
<a4j:support event="onkeyup"
reRender="ruleTest" action="#{startupBean.doApprove}"/>
</h:inputText>
<h:outputText value="#{startupBean.result}"
id="ruleTest"/>
</rich:panel>
</h:form>
</f:view>
</body>
</html>
The fist time rendered output like following,
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body>
</html>
When the javax.faces.ViewState hidden param injection made a Post Request like below
AJAXREQUEST=_viewRoot&j_id2=j_id2&j_id2%3Aj_id4=hello&javax.faces.ViewState=_id2"<script>alert(document.cookie);</script>&j_id2%3Aj_id5=j_id2%3Aj_id5&
rendered response is
<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title></title><link type="text/css"
rel="stylesheet"
href="/a4j_3_1_2.GAcss/panel.xcss/DATB/eAGTWzQ.BgAD.AG8.jsf" /><script
type="text/javascript"
src="/a4j_3_1_2.GAorg.ajax4jsf.javascript.AjaxScript.jsf">
</script></head>
<body><span id="j_id2:ruleTest">world</span><meta
name="Ajax-Update-Ids" content="j_id2:ruleTest" /><span
id="ajax-view-state"><input type="hidden"
name="javax.faces.ViewState" id="javax.faces.ViewState"
value="_id2" /><script type="text/javascript">//<![CDATA[
alert(document.cookie);
//]]>
</script>" /></span><meta id="Ajax-Response"
name="Ajax-Response" content="true" /></body></html>
I'm not sure it's jsf-ri issue or richfaces, but if
javax.faces.STATE_SAVING_METHOD set to client,
I couldn't reproduce the same issue.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6225
days inactive
6246
days old
richfaces-issues@lists.jboss.org
6 comments
5 participants
participants (5)
-
Anton Belevich (JIRA) -
Nick Belaevski (JIRA)
-
Tomoharu Fujita (JIRA)
-
Tsikhon Kuprevich (JIRA)
-
Viktor Volkov (JIRA)