Re: Security concern in the way to populate context

[Scott Gray]

Hi Patrick,

I think a jira issue for this would be a good idea.

Regards
Scott

HotWax Media
http://www.hotwaxmedia.com

On 25/11/2009, at 9:12 AM, Patrick Antivackis wrote:

Hello,

parameters can override session and application attributes.
The way to create the parameters map isthe following in
UtilHttp.getCombinedMap :


bottom level application attributes

session overrides application

parameters override session

attributes trump them all


understand why Parameters can override them.

For example if you try the following :
https://localhost:8443/webtools/control/main?mainDecoratorLocation=component://ecommerce/widget/CommonScreens.xml


putting in the web.xml, can be overriden by get or post parameters.

Do I miss something, or should I filled a JIRA ?
Thank you

I discover that in the parameters map available in the context, get or post combinedMap.putAll(getServletContextMap(request, namesToSkip)); // combinedMap.putAll(getSessionMap(request, namesToSkip)); // combinedMap.putAll(getParameterMap(request)); // combinedMap.putAll(getAttributeMap(request)); // I understand that session can override application attributes, but I dont You will be surprised. This also mean, that whatever configuration you are

smime.p7s
Description: S/MIME cryptographic signature