[
https://issues.apache.org/struts/browse/WW-2107?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_42141
]
Nestor Boscan commented on WW-2107:
-----------------------------------
So basically the problem is that it's evaluating two expression languages JSTL
+ OGNL. I don't think that a good solution is to simply eliminate JSTL, why not
eliminate OGNL some will say. One solution that I propose is to let the
developer choose which language it wants to evaluate INSIDE the tag. I can
choose between OGNL, JSTL, etc. Inside the tag you will evaluate the expression
using the choosen languages. This way we can choose the language that we like
and make Struts 2 extensible for other expression languages.
Regards,
Néstor Boscán
> Arbitrary user-submitted OGNL possible when using JSP EL or FreeMarker
> ----------------------------------------------------------------------
>
> Key: WW-2107
> URL: https://issues.apache.org/struts/browse/WW-2107
> Project: Struts 2
> Issue Type: Bug
> Components: Views
> Affects Versions: 2.0.9
> Reporter: Don Brown
> Assignee: Don Brown
> Priority: Blocker
> Fix For: 2.0.10
>
>
> It is possible for a user to submit malicious OGNL that could be executed in
> a page that uses JSP EL expressions in Struts tag attributes. FreeMarker
> pages that use FreeMarker expressions in Struts tag attributes are also
> affected. Velocity pages are not affected.
> For example, say you had this JSP page fragement:
> <s:text name="foo" value="${bar}" />
> And a user submitted, via a validation error or request url query parameter,
> the value:
> bar=%{1+1}
> What happens is the JSP processor gets the page first and processes the JSP
> EL expression resulting in:
> <s:text name="foo" value="%{1+1}" />
> Then, the Struts 2 tag receives the 'value' attribute value and processes the
> OGNL expression, resulting in this:
> <input type="text" name="foo" value="2" />
> The workaround is to ensure you don't use JSP EL or FreeMarker expressions in
> Struts tag attributes because you could be unwittingly allowing arbitrary
> code execution.
> The proposed solution is to turn off, via the TLD, JSP EL expressions in all
> Struts tag attributes. This will mostly likely break many Struts 2
> applications, but the severity of the issue needs to be taken into account.
> This solution doesn't unfortunately resolve the FreeMarker issue.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
