[
https://issues.apache.org/jira/browse/SLING-10147?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17289955#comment-17289955
]
Bertrand Delacretaz commented on SLING-10147:
---------------------------------------------
bq. Can I require that the optional WebConsoleSecurityProvider be present to
allow access? Is that any different than assuming that the resource tree is
writable and capable of defining a /system/sling/permissions/webconsole/view
resource?
Requiring the {{WebConsoleSecurityProvider}} service sounds reasonable to me,
especially as IIUC the webconsole functionality that you are protecting here is
not something critical that would prevent troubleshooting a Sling instance.
IIUC that would greatly simplify your code?
If you go that route I suggest doing a LAZY vote on our dev list about
approving that option, as others might have different views (looks like Konrad
and myself take this from different angles for example) and it's good to expose
such "architectural" decisions to our developers community. But if it makes
your code dramatically simpler I think that's a reasonable choice.
> scripting variables implementation details are exposed to not authorized users
> ------------------------------------------------------------------------------
>
> Key: SLING-10147
> URL: https://issues.apache.org/jira/browse/SLING-10147
> Project: Sling
> Issue Type: Bug
> Reporter: Eric Norman
> Assignee: Eric Norman
> Priority: Major
> Fix For: Scripting Core 2.3.6
>
> Time Spent: 3h 50m
> Remaining Estimate: 0h
>
> The ".SLING_availablebindings.json" selector is registered at
> /apps/sling/servlet/default and the usage on all resources is not protected
> by any security checks. The information returned contains implementation
> details that a regular user should not need to know and could be considered
> an "information disclosure" vulnerability.
> Since this selector appears to only be used by the "Scripting Variables"
> webconsole plugin, I would expect that it should require the same security
> checking that would be needed to access the webconsole.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
