[seam-dev] Re: Adding a security audit to the Seam QA (release) process

Hi Pete, that sounds like a good plan, let's schedule some initial planning for next week, because this week I am quite busy with after-PTO workload and SOA testing. How about next tuesday? BTW, which timezone are you in, maybe we can start with a phone chat? The first things that come into my mind are JSF view state injection, XSS in all different kinds, remoting misuse, insecure servlet mappings. During this week I will catch with the current Seam codebase by findbugs-ing through it, and maybe already stumble over the one or other place to start poking into. Cheers Marc Pete Muir wrote: > Hi Marc, > > Something that we've been discussing is the idea creating a security > audit checklist that will cover Seam and the ways it interacts with > the outside world; initially, we want to focus on JSF, Seam Remoting > (Ajax) and Servlet but we will also consider adding in WS including > JAX-RS, Wicket, GWT and perhaps others, though these are what I can > think off. This checklist would then be added to the Seam QA process > (which is run through at release time). > > We were wondering if you would be able to work with us on this? My > suggestion is, that as you (I hope ;-) have a good understanding of > the general approaches that could be used to exploit a Seam that you > would be to work with us both on an initial list of areas to focus > on, > and then help us develop the checklist. > > Let us know :) > > Pete -- Marc Schoenefeld / Red Hat Security Response Team