It's interesting that no one says DispatchAction in 1.x is a security
flaw... doesn't that give you exactly the same thing just with a
different call semantic? I guess we should quick drop Dispatch-type
Actions for everyones' safety!! ;) LOL
I'm with you Ian... doesn't seem like a security flaw to me... it's just
a nice way to cut down on config file clutter in the end. Public vs.
private does the trick as far as "security" goes I'd say, adding an
annotation to maybe make it more explicit wouldn't hurt...
...unless you really want to take the security exercise all the way,
i.e., secure each and every method via container-managed security using
annotations (ideally) to configure what roles/users can access what
methods, thereby taking the URI out of the equation entirely... if you
aren't in an allowed role, you can't execute the method, regardless of
what URI was used to request it.
Might not be a bad feature actually, but seems like a bit of overkill to
me :)
Frank
Bob Lee wrote:
On 8/25/06, Ian Roughley <[EMAIL PROTECTED]> wrote:
I have to say that I still don't really understand why this is a
security flaw. I can understand that calling any public method on a
class may not be a good thing, but let's face it, actions are *meant* to
be called via a URL. If there is a security issue - then it is an
application security issue - because the method is NOT doing the
required checks to ensure this is a valid request.
Good point. Why require an annotation when you can just not make your
method
public? If we're afraid users won't know about this feature and will
accidentally leave methods public, more prominently document the feature.
Bob
--
Frank W. Zammetti
Founder and Chief Software Architect
Omnytex Technologies
http://www.omnytex.com
AIM/Yahoo: fzammetti
MSN: [EMAIL PROTECTED]
Author of "Practical Ajax Projects With Java Technology"
(2006, Apress, ISBN 1-59059-695-1)
Java Web Parts - http://javawebparts.sourceforge.net
Supplying the wheel, so you don't have to reinvent it!
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
