CWE-749 GWT and eval()

2024-06-04 Thread Giacomo Petronio
When we run automated security scan against our GWT project, one of the main vulnerability is related to the presence of eval() functions in the .nocache.js file ...{j=k.substring(Z,m);l=k.substring(m+$)}else{j=k;l=fb}c[j]=l}}else

Re: GWT RPC and CSP with unsafe-eval

2024-05-31 Thread Giacomo Petronio
I have to correct myself: every RPC call fails, not just one in particular. On Friday, May 31, 2024 at 2:48:48 PM UTC+2 Giacomo Petronio wrote: > I upgraded to GWT 2.11.0 and introduced the CSP header disallowing > unsafe-eval, but now one (not all) RPC call fails since it hits a

GWT RPC and CSP with unsafe-eval

2024-05-31 Thread Giacomo Petronio
I upgraded to GWT 2.11.0 and introduced the CSP header disallowing unsafe-eval, but now one (not all) RPC call fails since it hits an eval() function that is blocked by the browser. I saw that there is an issue with RPC with large payloads (> 64kb

GWT RPC call recognized as a Java Method Injection by Fortiweb

2023-07-21 Thread Giacomo Petronio
We have one deployment of a GWT app where there is a Fortiweb firewall that blocks every GWT RPC call because it recognizes every call as a Java Method Injection attack. This seems to be caused by the presence of the pattern "java.lang." in the messages from the client to the server like the

Re: Document.get().getElementById(String) and $doc.getElementById(String) returning nulls

2010-07-02 Thread giacomo
(tagName));     } } Then you can use: ContainerTag div = new ContainerTag(div); Daniel On Thu, Jul 1, 2010 at 12:13 PM, giacomo gia.ghid...@gmail.com wrote: Hi everyone! SUMMARY = I'm facing a problem with Document.get().getElementById(String) (in Java

Document.get().getElementById(String) and $doc.getElementById(String) returning nulls

2010-07-01 Thread giacomo
Hi everyone! SUMMARY = I'm facing a problem with Document.get().getElementById(String) (in Java) and $doc.getElementById(String) (in JavaScript) returning nulls. My design goal is to define a div element in the Java code and add it to the document, so that I can then retrieve it in the

Re: Deploying GWT 1.6.4 RPC Web App to Knopflerfish OSGi Framework

2009-06-04 Thread giacomo
. So you need to use Jetty. Hope that this answers to your question. Regards, Baptiste Boussemart On 3 juin, 23:54, giacomo gia.ghid...@gmail.com wrote: Hi everyone! I'm trying to get the simple Web application in GWT 1.6.4 featuring GWT RPC to work in Knopflerfish OSGi framework 2.3.1

Deploying GWT 1.6.4 RPC Web App to Knopflerfish OSGi Framework

2009-06-03 Thread giacomo
Hi everyone! I'm trying to get the simple Web application in GWT 1.6.4 featuring GWT RPC to work in Knopflerfish OSGi framework 2.3.1 (an implementation of the OSGi framework like Equinox). For that matter I created an OSGi bundle from the GWT project and added an implementation of