[MYFACES-4133] Don't deserialize the ViewState-ID if the state saving method is server

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.12
• Fix Version/s: 2.3.0
• Component/s: General
• Assignee: Thomas Andraschko
• Reporter: Peter Stöckli
• Created: 15/Aug/17 15:53
• Updated: 29/Jan/18 20:04
• Resolved: 29/Jan/18 19:32

Description

Currently the ViewState-ID provided by the user is deserialized via Java deserialization even when the javax.faces.STATE_SAVING_METHOD is set to server (the default).

The deserialization in this case is unecessary and most likely even slower than just sending the ViewState Id directly.
If a developer now disables the ViewState encryption by setting org.apache.myfaces.USE_ENCRYPTION to false (against the MyFaces security advice) he might have unintentionally introduced a dangerous remote code execution (RCE) vulnerability as described here.

This has been discussed before on Issue MYFACES-4021.