The applications using the data may write solr data to the dom. (I doubt they do but they could now or in the future. They have an expectation of trusting the data back from solr).
As a straight forward attack you are right though. But it is incorrect behavior? It should not produce bogus fields and values for each record returned ? On 26 November 2014 at 15:34, Yonik Seeley <yo...@heliosearch.com> wrote: > It would have been helpful if you would have pointed out exactly what > you think the problem is. > I still don't see an issue, since it doesn't look like any > encapsulation has been broken. > > -Yonik > http://heliosearch.org - native code faceting, facet functions, > sub-facets, off-heap data > > > On Wed, Nov 26, 2014 at 9:56 AM, Lee Carroll > <lee.a.carr...@googlemail.com> wrote: > > Hi All, > > In solr 4.7 this query > > /solr/coreName/select/?q=*:*&fl=%27nasty%20value%27&rows=1&wt=json > > > > returns > > > > > {"responseHeader":{"status":0,"QTime":2},"response":{"numFound":189796,"start":0,"docs":[{"'nasty > > value'":"nasty value"}]}} > > > > This is naughty. Has this been seen before / fixed ? >
