[
https://issues.apache.org/jira/browse/SLING-10147?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17286983#comment-17286983
]
Bertrand Delacretaz commented on SLING-10147:
---------------------------------------------
Wouldn't it be simpler to block access to the
[SlingBindingsVariablesListJsonServlet|https://github.com/apache/sling-org-apache-sling-scripting-core/blob/master/src/main/java/org/apache/sling/scripting/core/impl/SlingBindingsVariablesListJsonServlet.java]
unless the current request can read a specific node in the repository?
The Sling Pipes
[PlumberImpl|https://github.com/apache/sling-org-apache-sling-pipes/blob/de2932b92881b0351881f87f73ac5551b52e5dde/src/main/java/org/apache/sling/pipes/internal/PlumberImpl.java#L195]
is using such mechanism: attempt to get
{{/system/sling/permissions/pipes/exec}} with {{ResourceResolver.getResource}}
and if that fails refuse to execute the current operation.
That's just a few lines of code to implement, and you can then use regular JCR
access control to define who can execute the servlet in question, I think
that's convenient.
> scripting variables implementation details are exposed to not authorized users
> ------------------------------------------------------------------------------
>
> Key: SLING-10147
> URL: https://issues.apache.org/jira/browse/SLING-10147
> Project: Sling
> Issue Type: Bug
> Reporter: Eric Norman
> Priority: Major
> Fix For: Scripting Core 2.3.6
>
> Time Spent: 2h 10m
> Remaining Estimate: 0h
>
> The ".SLING_availablebindings.json" selector is registered at
> /apps/sling/servlet/default and the usage on all resources is not protected
> by any security checks. The information returned contains implementation
> details that a regular user should not need to know and could be considered
> an "information disclosure" vulnerability.
> Since this selector appears to only be used by the "Scripting Variables"
> webconsole plugin, I would expect that it should require the same security
> checking that would be needed to access the webconsole.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
