[SHALE-362] Improve default security of Shale Remoting

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0.4-SNAPSHOT
• Fix Version/s: 1.0.4
• Component/s: Remoting
• Assignee: Unassigned
• Reporter: Craig R. McClanahan
• Created: 14/Dec/06 08:39
• Updated: 23/Jan/07 16:40
• Resolved: 14/Dec/06 08:43

Description

The current "out of the box" security of Shale Remoting is better (in 1.0.4-SNAPSHOT) than it was in 1.0.3, but still needs to be improved:

• "Dynamic" processor should exclude by default all managed bean
  names that are implicitly defined in the JSF spec, and have public
  zero-args methods that might mess things up. (Example: executing
  # {applicationScope.clear}

  would be bad.

• All processors should be enhanced to always obey their default
  exclude lists, even if the user specifies additional exclude patterns.