[seam-commits] Seam SVN: r14085 - in branches/community/Seam_2_2/src/main/org/jboss/seam: core and 1 other directories.

[seam-commits at lists.jboss.org]

Author: manaRH
Date: 2011-04-22 05:36:42 -0400 (Fri, 22 Apr 2011)
New Revision: 14085

Added:
   branches/community/Seam_2_2/src/main/org/jboss/seam/blacklist.properties
Modified:
   branches/community/Seam_2_2/src/main/org/jboss/seam/core/Expressions.java
   branches/community/Seam_2_2/src/main/org/jboss/seam/navigation/Pages.java
Log:
JBPAPP-4804

Added: branches/community/Seam_2_2/src/main/org/jboss/seam/blacklist.properties
===================================================================
--- branches/community/Seam_2_2/src/main/org/jboss/seam/blacklist.properties	                        (rev 0)
+++ branches/community/Seam_2_2/src/main/org/jboss/seam/blacklist.properties	2011-04-22 09:36:42 UTC (rev 14085)
@@ -0,0 +1,4 @@
+.getClass()
+.addRole(
+.getPassword(
+.removeRole(
\ No newline at end of file

Modified: branches/community/Seam_2_2/src/main/org/jboss/seam/core/Expressions.java
===================================================================
--- branches/community/Seam_2_2/src/main/org/jboss/seam/core/Expressions.java	2011-04-21 14:32:43 UTC (rev 14084)
+++ branches/community/Seam_2_2/src/main/org/jboss/seam/core/Expressions.java	2011-04-22 09:36:42 UTC (rev 14085)
@@ -3,7 +3,13 @@
 
 import static org.jboss.seam.annotations.Install.BUILT_IN;
 
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
 import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
 
 import javax.el.ELContext;
 import javax.el.ExpressionFactory;
@@ -17,6 +23,8 @@
 import org.jboss.seam.contexts.Contexts;
 import org.jboss.seam.el.EL;
 import org.jboss.seam.el.SeamExpressionFactory;
+import org.jboss.seam.log.LogProvider;
+import org.jboss.seam.log.Logging;
 
 /**
  * Factory for EL method and value expressions.
@@ -31,7 +39,41 @@
 @Name("org.jboss.seam.core.expressions")
 public class Expressions implements Serializable
 {
+   private static final LogProvider log = Logging.getLogProvider(Expressions.class);
+   private static List<String> blacklist = new ArrayList<String>();
    
+   // loading blacklisted patterns of non-valid EL expressions
+   static 
+   {
+      BufferedReader reader = null;
+      try
+      {
+         InputStream blacklistIS = ResourceLoader.instance().getResourceAsStream("blacklist.properties");
+         reader = new BufferedReader(new InputStreamReader(blacklistIS));
+         String line; 
+         while ((line = reader.readLine()) != null)
+         {
+            blacklist.add(line);
+         }
+      }
+      catch (IOException e)
+      {
+         log.warn("Black list of non-valid EL expressions was not found!");
+      }
+      finally
+      {
+         if (reader != null)
+         {
+            try
+            {
+               reader.close();
+            }
+            catch (IOException e) { }
+         }
+      }
+      
+   }
+   
    /**
     * Get the JBoss EL ExpressionFactory
     */
@@ -76,6 +118,8 @@
     */
    public <T> ValueExpression<T> createValueExpression(final String expression, final Class<T> type)
    {
+
+      checkELExpression(expression);
       
       return new ValueExpression<T>()
       {
@@ -140,6 +184,8 @@
     */
    public <T> MethodExpression<T> createMethodExpression(final String expression, final Class<T> type, final Class... argTypes)
    {
+      checkELExpression(expression);
+      
       return new MethodExpression<T>()
       {
          private javax.el.MethodExpression facesMethodExpression;
@@ -257,4 +303,21 @@
            return (Expressions) Component.getInstance(Expressions.class, ScopeType.APPLICATION);
        }
    }
+   
+   private static void checkELExpression(final String expression)
+   {
+      for (int index = 0; blacklist.size() > index; index++)
+      {
+         if ( expression.contains(blacklist.get(index)) ) {
+            throw new IllegalArgumentException("This EL expression is not allowed!");
+         }
+      }
+      
+      // for any case blacklist is not provided this is definitely not permitted
+      if ( expression.contains(".getClass()") )
+      {
+         throw new IllegalArgumentException("This EL expression is not allowed!");
+      }
+   }
+
 }

Modified: branches/community/Seam_2_2/src/main/org/jboss/seam/navigation/Pages.java
===================================================================
--- branches/community/Seam_2_2/src/main/org/jboss/seam/navigation/Pages.java	2011-04-21 14:32:43 UTC (rev 14084)
+++ branches/community/Seam_2_2/src/main/org/jboss/seam/navigation/Pages.java	2011-04-22 09:36:42 UTC (rev 14085)
@@ -697,6 +697,10 @@
                .getRequestParameterMap().get("actionMethod");
          if (actionId!=null)
          {
+            String decodedActionId = URLDecoder.decode(actionId);
+            if (decodedActionId != null && (decodedActionId.indexOf('#') >= 0 || decodedActionId.indexOf('{') >= 0) ){
+               throw new IllegalArgumentException("EL expressions are not allowed in actionMethod parameter");
+            }
             if ( !SafeActions.instance().isActionSafe(actionId) ) return result;
             String expression = SafeActions.toAction(actionId);
             result = true;