[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1137) Potentially large security hole in Seam Captcha implementation
by Ian Hlavats (JIRA)
Potentially large security hole in Seam Captcha implementation
--------------------------------------------------------------
Key: JBSEAM-1137
URL: http://jira.jboss.com/jira/browse/JBSEAM-1137
Project: JBoss Seam
Issue Type: Bug
Components: Security
Affects Versions: 1.2.0.GA
Environment: Any
Reporter: Ian Hlavats
I have been experiencing "holes" in the Seam captcha integration recently.
The Seam documentation (section 21.1.1) recommends client-side state saving for JSF.
The following scenario should point out a potential security issue with this approach.
Suppose I have a JSF page with a typical user comment form on it that does not use Seam's captcha component.
Now a malicious user scrapes my JSF page and stores a local copy on his computer, serialized UI component tree and all.
In the meantime, I add Seam's captcha component to my JSF page, trusting it to cause a validation error when the form is submitted without the correct captcha text.
Can the malicious user can now submit the previous copy of my form without the captcha component in the tree?
I am using the MyFaces 1.1.4 JSF implementation.
Thanks.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 7 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-951) IDE support for "Seam Component" project view
by Christian Bauer (JIRA)
IDE support for "Seam Component" project view
---------------------------------------------
Key: JBSEAM-951
URL: http://jira.jboss.com/jira/browse/JBSEAM-951
Project: JBoss Seam
Issue Type: Feature Request
Components: Tools
Reporter: Christian Bauer
Assigned To: Max Andersen
In IntelliJ I can change the project navigator view to different scopes, a scope being a user-defined filter with a package name regex. This is not what I want, I want a project navigator display where the root folders are "Stateless", "Application", "Event", "Conversation", "Session", "Entities", and maybe "Other", and the second grouping is by package name (or whatever custom scope).
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 8 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-1041) Pages: isLoginRedirectRequired should be called before applying request parameter values
by Darryl Smith (JIRA)
Pages: isLoginRedirectRequired should be called before applying request parameter values
----------------------------------------------------------------------------------------
Key: JBSEAM-1041
URL: http://jira.jboss.com/jira/browse/JBSEAM-1041
Project: JBoss Seam
Issue Type: Bug
Components: Security
Affects Versions: 1.2.0.GA
Reporter: Darryl Smith
Seam will apply page parameters before it does the checks to see if login redirection is required.
This is problematic for applications rely on session scope information created in authenticator being present
e.g. using @In(scope=SESSION) currentUser, or using @In(scope=SESSION) Identity identity, or any factory that depends on identity information
12:16:53,383 ERROR [DebugPageHandler] redirecting to debug page
org.jboss.seam.RequiredException: In attribute requires non-null value: userBrowseQueryFactory.currentUser
at org.jboss.seam.Component.getValueToInject(Component.java:1887)
at org.jboss.seam.Component.injectAttributes(Component.java:1336)
at org.jboss.seam.Component.inject(Component.java:1163)
at org.jboss.seam.interceptors.BijectionInterceptor.aroundInvoke(BijectionInterceptor.java:46)
at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:69)
at org.jboss.seam.interceptors.MethodContextInterceptor.aroundInvoke(MethodContextInterceptor.java:27)
at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:69)
at org.jboss.seam.intercept.RootInterceptor.invoke(RootInterceptor.java:103)
at org.jboss.seam.intercept.JavaBeanInterceptor.interceptInvocation(JavaBeanInterceptor.java:154)
at org.jboss.seam.intercept.JavaBeanInterceptor.intercept(JavaBeanInterceptor.java:89)
at edu.uga.ais.piac.pva.action.user.UserBrowseQueryFactory$$EnhancerByCGLIB$$5ef43164.setFirstResult(<generated>)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.myfaces.el.PropertyResolverImpl.setProperty(PropertyResolverImpl.java:406)
at org.apache.myfaces.el.PropertyResolverImpl.setValue(PropertyResolverImpl.java:173)
at org.apache.myfaces.el.ValueBindingImpl.setValue(ValueBindingImpl.java:275)
at org.jboss.seam.core.Expressions$1.setValue(Expressions.java:67)
at org.jboss.seam.core.Pages.applyRequestParameterValues(Pages.java:608)
at org.jboss.seam.jsf.AbstractSeamPhaseListener.beforeRender(AbstractSeamPhaseListener.java:176)
at org.jboss.seam.jsf.SeamPhaseListener.beforePhase(SeamPhaseListener.java:57)
at org.apache.myfaces.lifecycle.PhaseListenerManager.informPhaseListenersBefore(PhaseListenerManager.java:70)
at org.apache.myfaces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:373)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:138)
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 8 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-947) Problem with seam component <s:fileUpload/> in JBoss Portal
by Pietro Passantini (JIRA)
Problem with seam component <s:fileUpload/> in JBoss Portal
-----------------------------------------------------------
Key: JBSEAM-947
URL: http://jira.jboss.com/jira/browse/JBSEAM-947
Project: JBoss Seam
Issue Type: Bug
Components: JSF
Affects Versions: 1.1.6.GA, 1.1.5.GA
Environment: Windows XP Pro service pack 2, I.E. and FireFox, JBossAS 4.0.5.GA, JBoss Portal 2.4.1
Reporter: Pietro Passantini
I need to upload a file to Jackrabbit Repository using Seam Framework running on Portlet, with the <s:fileUpload/> component.
It doesn't work.
I've tried different ways to solve the problem, but none worked.
It could be a bug.
It seams that when the enctype of h:form is ="multipart/form-data", the method upload of fileManager is not called; if I don't set the enctype of h:form the method upload is called, but the bean file is null.
I'm trying with this configutaration:
JSP
<h:form id="myForm" enctype="multipart/form-data" >
<s:fileUpload accept="" fileName="#{file.filename}" data="#{file.data}" />
<h:commandButton value="Upload" action="#{fileManager.upload}"/>
</h:form>
BEAN
"file" is the bean that represents the file uploaded
"fileManager" is the bean that use the file uploaded
WEB.XML
...
<filter-name>Seam Filter</filter-name>
<filter-class>org.jboss.seam.servlet.SeamMultipartFilter</filter-class>
<filter-mapping>
<filter-name>Seam Filter</filter-name>
<url-pattern>*.seam</url-pattern>
</filter-mapping>
...
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 9 months
[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-761) Modify the default interception practices
by Mike Quilleash (JIRA)
Modify the default interception practices
-----------------------------------------
Key: JBSEAM-761
URL: http://jira.jboss.com/jira/browse/JBSEAM-761
Project: JBoss Seam
Issue Type: Feature Request
Components: Core
Affects Versions: 1.1.0.GA
Environment: Any.
Reporter: Mike Quilleash
Currently all methods on a Seam component will be intercepted. In some circumstances this can make debugging difficult as a lot of debuggers call toString() on objects visible from the breakpoint which executes all the Bijection incl the DisInjection which can damage the state of the object depending where the breakpoint is in the process.
Perhaps the interception logic could ignore calls to any method on the Object class so the default toString() doesn't cause problems.
Another complementary change would be to expand the @Intercept to be allowed on methods (and fields?) to allow the interception logic to be configured on individual methods (like a custom toString()) method.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
18 years, 9 months