[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3592) Security concerns regarding Seam.Remoting.eval()

[Drew Kutchar (JIRA)]

Security concerns regarding Seam.Remoting.eval()
------------------------------------------------

                 Key: JBSEAM-3592
                 URL: https://jira.jboss.org/jira/browse/JBSEAM-3592
             Project: Seam
          Issue Type: Task
          Components: Remoting
            Reporter: Drew Kutchar
            Assignee: Shane Bryzak


A malicious user can import the seam/remoting/resource/remote.js and use Seam.Remoting.eval() to bypass @WebRemote restrictions and call any arbitrary method? This can be a very serious security hole, even if Seam Remoting is not enabled (by marking any components using @WebRemote).

Shane Bryzak stated that he is aware of this issue and has disabled Seam.Remoting.eval() functionality until he finds a way for expression evaluations to honor the @WebRemote annotation.

This JIRA is created to track Shane's work.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira