[
https://issues.apache.org/jira/browse/WW-4751?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15978237#comment-15978237
]
Yasser Zamani commented on WW-4751:
-----------------------------------
WW-4105 nicely fixed by this approach i.e. considering config time class of
action when copying properties in actions chain :) you can see a [list of
changes
here|https://github.com/yasserzamani/struts/commit/e95224f26aa17dad6ad490473b4aeab1d2ceaf79].
Now I am working on Parameters Interceptor. Considering config time class of
action there, enhances S2 security by preventing proxy information of a proxied
action to be changed by attacker!
> Struts2 should know and consider config time class of user's Actions
> --------------------------------------------------------------------
>
> Key: WW-4751
> URL: https://issues.apache.org/jira/browse/WW-4751
> Project: Struts 2
> Issue Type: Improvement
> Reporter: Yasser Zamani
> Priority: Minor
> Fix For: 2.5.next
>
>
> I see some issues like WW-4105 , WW-4694 and WW-4498 suffers lack of this
> information i.e. config time class of user's action.
> I also know future issues like below are possible or potential to occur when
> Struts2 give Actions up to an object factory and, himself does not know any
> more about Action's real class (i.e. when user set className to a bean name
> inside his object factory):
> * JSONResult will fail or will generate ugly json when the action is an AOPed
> proxy. Because JSONResult tries to generate json from un-relevant information
> like advices and etc.
> * In a security point of view, someone may successfully change that action
> proxy or aop information simply by calling that action submitting some named
> parameters.
> I know these are solvable by enforcing user to specify includes/excludes
> parameters but more better and beauty approach is as below:
> (proxied action) -> ... -> (some subclass of action) -> ... -> (*user config
> time specified class*) -> ... -> (some superclass of action) -> ... ->
> Struts2's ActionSupport -> ...
> If we suppose the above as type hierarchy of the action, knowing *user config
> time specified class*, Struts2 can exclude all sub-classes above this class
> and all super classes under and including ActionSupport in all sensitive
> places to avoid potential future issues.
> What do you think? :)
--
This message was sent by Atlassian JIRA
(v6.3.15#6346)
