[seam-issues] [JBoss JIRA] Resolved: (SEAMREMOTING-10) Security concerns regarding Seam.Remoting.eval()

Security concerns regarding Seam.Remoting.eval() ------------------------------------------------ Key: SEAMREMOTING-10 URL: https://issues.jboss.org/browse/SEAMREMOTING-10 Project: Seam Remoting Issue Type: Task Reporter: Drew Kutchar Assignee: Shane Bryzak A malicious user can import the seam/remoting/resource/remote.js and use Seam.Remoting.eval() to bypass @WebRemote restrictions and call any arbitrary method? This can be a very serious security hole, even if Seam Remoting is not enabled (by marking any components using @WebRemote). Shane Bryzak stated that he is aware of this issue and has disabled Seam.Remoting.eval() functionality until he finds a way for expression evaluations to honor the @WebRemote annotation. This JIRA is created to track Shane's work.