[seam-issues] [JBoss JIRA] Commented: (SEAMREMOTING-10) Security concerns regarding Seam.Remoting.eval()

Shane Bryzak (JIRA) jira-events at lists.jboss.org
Tue Oct 26 18:56:55 EDT 2010


    [ https://jira.jboss.org/browse/SEAMREMOTING-10?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12559521#action_12559521 ] 

Shane Bryzak commented on SEAMREMOTING-10:
------------------------------------------

This issue is still relevant for Seam 3

> Security concerns regarding Seam.Remoting.eval()
> ------------------------------------------------
>
>                 Key: SEAMREMOTING-10
>                 URL: https://jira.jboss.org/browse/SEAMREMOTING-10
>             Project: Seam Remoting
>          Issue Type: Task
>            Reporter: Drew Kutchar
>            Assignee: Shane Bryzak
>
> A malicious user can import the seam/remoting/resource/remote.js and use Seam.Remoting.eval() to bypass @WebRemote restrictions and call any arbitrary method? This can be a very serious security hole, even if Seam Remoting is not enabled (by marking any components using @WebRemote).
> Shane Bryzak stated that he is aware of this issue and has disabled Seam.Remoting.eval() functionality until he finds a way for expression evaluations to honor the @WebRemote annotation.
> This JIRA is created to track Shane's work.

-- 
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

        


More information about the seam-issues mailing list