4:36 a.m.
Author: manaRH
Date: 2011-04-22 05:36:42 -0400 (Fri, 22 Apr 2011)
New Revision: 14085
Added:
branches/community/Seam_2_2/src/main/org/jboss/seam/blacklist.properties
Modified:
branches/community/Seam_2_2/src/main/org/jboss/seam/core/Expressions.java
branches/community/Seam_2_2/src/main/org/jboss/seam/navigation/Pages.java
Log:
JBPAPP-4804
Added: branches/community/Seam_2_2/src/main/org/jboss/seam/blacklist.properties
===================================================================
--- branches/community/Seam_2_2/src/main/org/jboss/seam/blacklist.properties
(rev 0)
+++ branches/community/Seam_2_2/src/main/org/jboss/seam/blacklist.properties 2011-04-22
09:36:42 UTC (rev 14085)
@@ -0,0 +1,4 @@
+.getClass()
+.addRole(
+.getPassword(
+.removeRole(
\ No newline at end of file
Modified: branches/community/Seam_2_2/src/main/org/jboss/seam/core/Expressions.java
===================================================================
--- branches/community/Seam_2_2/src/main/org/jboss/seam/core/Expressions.java 2011-04-21
14:32:43 UTC (rev 14084)
+++ branches/community/Seam_2_2/src/main/org/jboss/seam/core/Expressions.java 2011-04-22
09:36:42 UTC (rev 14085)
@@ -3,7 +3,13 @@
import static org.jboss.seam.annotations.Install.BUILT_IN;
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
import javax.el.ELContext;
import javax.el.ExpressionFactory;
@@ -17,6 +23,8 @@
import org.jboss.seam.contexts.Contexts;
import org.jboss.seam.el.EL;
import org.jboss.seam.el.SeamExpressionFactory;
+import org.jboss.seam.log.LogProvider;
+import org.jboss.seam.log.Logging;
/**
* Factory for EL method and value expressions.
@@ -31,7 +39,41 @@
@Name("org.jboss.seam.core.expressions")
public class Expressions implements Serializable
{
+ private static final LogProvider log = Logging.getLogProvider(Expressions.class);
+ private static List<String> blacklist = new ArrayList<String>();
+ // loading blacklisted patterns of non-valid EL expressions
+ static
+ {
+ BufferedReader reader = null;
+ try
+ {
+ InputStream blacklistIS =
ResourceLoader.instance().getResourceAsStream("blacklist.properties");
+ reader = new BufferedReader(new InputStreamReader(blacklistIS));
+ String line;
+ while ((line = reader.readLine()) != null)
+ {
+ blacklist.add(line);
+ }
+ }
+ catch (IOException e)
+ {
+ log.warn("Black list of non-valid EL expressions was not found!");
+ }
+ finally
+ {
+ if (reader != null)
+ {
+ try
+ {
+ reader.close();
+ }
+ catch (IOException e) { }
+ }
+ }
+
+ }
+
/**
* Get the JBoss EL ExpressionFactory
*/
@@ -76,6 +118,8 @@
*/
public <T> ValueExpression<T> createValueExpression(final String
expression, final Class<T> type)
{
+
+ checkELExpression(expression);
return new ValueExpression<T>()
{
@@ -140,6 +184,8 @@
*/
public <T> MethodExpression<T> createMethodExpression(final String
expression, final Class<T> type, final Class... argTypes)
{
+ checkELExpression(expression);
+
return new MethodExpression<T>()
{
private javax.el.MethodExpression facesMethodExpression;
@@ -257,4 +303,21 @@
return (Expressions) Component.getInstance(Expressions.class,
ScopeType.APPLICATION);
}
}
+
+ private static void checkELExpression(final String expression)
+ {
+ for (int index = 0; blacklist.size() > index; index++)
+ {
+ if ( expression.contains(blacklist.get(index)) ) {
+ throw new IllegalArgumentException("This EL expression is not
allowed!");
+ }
+ }
+
+ // for any case blacklist is not provided this is definitely not permitted
+ if ( expression.contains(".getClass()") )
+ {
+ throw new IllegalArgumentException("This EL expression is not
allowed!");
+ }
+ }
+
}
Modified: branches/community/Seam_2_2/src/main/org/jboss/seam/navigation/Pages.java
===================================================================
--- branches/community/Seam_2_2/src/main/org/jboss/seam/navigation/Pages.java 2011-04-21
14:32:43 UTC (rev 14084)
+++ branches/community/Seam_2_2/src/main/org/jboss/seam/navigation/Pages.java 2011-04-22
09:36:42 UTC (rev 14085)
@@ -697,6 +697,10 @@
.getRequestParameterMap().get("actionMethod");
if (actionId!=null)
{
+ String decodedActionId = URLDecoder.decode(actionId);
+ if (decodedActionId != null && (decodedActionId.indexOf('#')
>= 0 || decodedActionId.indexOf('{') >= 0) ){
+ throw new IllegalArgumentException("EL expressions are not allowed in
actionMethod parameter");
+ }
if ( !SafeActions.instance().isActionSafe(actionId) ) return result;
String expression = SafeActions.toAction(actionId);
result = true;