tandraschko commented on PR #1044: URL: https://github.com/apache/myfaces/pull/1044#issuecomment-5276715429
Im not sure If we should do this at this amount of detail. In PrimeFaces we had a similar request If a user directly bind e.g. a request param via EL to a ImageCropper source. PF uses a URLConncection and would call this. Its a bit a decision: should a framework catch every possible user error for 100%? Maybe its enough to block external URL calls. If its path traversal, what could happen? MyFaces trying to parse anything else and throwing a exception, which leads to a Error Page? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
