[ https://issues.apache.org/jira/browse/SLING-2320?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13163062#comment-13163062 ]
Felix Meschberger commented on SLING-2320: ------------------------------------------ Thanks for providing the patch which looks basically good. Yet, I have the impression that ResourceTraversor and JsonResourceWriter are candidates for some rewrite ... For example the ResourceTraversor.adapt(Resource) methods uses the JsonResourceWriter to serialize a resource subtree to a String which is then parsed to get the JSONObject. This is far from clever .. (Visitor pattern comes to mind here with implementations for serialization in the JsonResourceWriter and JSONObject building in the ResourceTraversor.adapt method. > Current DOS-prevention for infinity.json can prevent enumeration of children > ---------------------------------------------------------------------------- > > Key: SLING-2320 > URL: https://issues.apache.org/jira/browse/SLING-2320 > Project: Sling > Issue Type: Bug > Components: Servlets > Affects Versions: Servlets Get 2.1.0 > Reporter: Jeff Young > Assignee: Felix Meschberger > Labels: newbie, patch > Attachments: jsonRenderer.diff > > Original Estimate: 1h > Remaining Estimate: 1h > > A request of resource.1.json should always succeed, as it's the primary > method for JSON introspection of the repository hierarchy. DOS protection > should only apply to "deep" traversals; that is, anything with a depth > greater than 1 (and, in particular, resource.infinity.json). > For a fuller discussion, see: > http://www.mail-archive.com/dev@sling.apache.org/msg13961.html. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira