[
https://issues.apache.org/jira/browse/SLING-2320?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13163062#comment-13163062
]
Felix Meschberger commented on SLING-2320:
------------------------------------------
Thanks for providing the patch which looks basically good.
Yet, I have the impression that ResourceTraversor and JsonResourceWriter are
candidates for some rewrite ... For example the
ResourceTraversor.adapt(Resource) methods uses the JsonResourceWriter to
serialize a resource subtree to a String which is then parsed to get the
JSONObject. This is far from clever .. (Visitor pattern comes to mind here with
implementations for serialization in the JsonResourceWriter and JSONObject
building in the ResourceTraversor.adapt method.
> Current DOS-prevention for infinity.json can prevent enumeration of children
> ----------------------------------------------------------------------------
>
> Key: SLING-2320
> URL: https://issues.apache.org/jira/browse/SLING-2320
> Project: Sling
> Issue Type: Bug
> Components: Servlets
> Affects Versions: Servlets Get 2.1.0
> Reporter: Jeff Young
> Assignee: Felix Meschberger
> Labels: newbie, patch
> Attachments: jsonRenderer.diff
>
> Original Estimate: 1h
> Remaining Estimate: 1h
>
> A request of resource.1.json should always succeed, as it's the primary
> method for JSON introspection of the repository hierarchy. DOS protection
> should only apply to "deep" traversals; that is, anything with a depth
> greater than 1 (and, in particular, resource.infinity.json).
> For a fuller discussion, see:
> http://www.mail-archive.com/dev@sling.apache.org/msg13961.html.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
