[STR-3206] classloader properties should not be tampered while populating ActionForm

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.3.10
• Component/s: Core
• Environment: any
• Flags: Patch, Important
• Assignee: Unassigned
• Reporter: Xiaohong Zheng
• Created: 12/Jul/10 20:42
• Updated: 12/Jul/10 20:56

Description

Current implentation in RequestUtils.populate(Object bean, String prefix, String suffix, HttpServletRequest request) allows an attacker to manipulate any settable classloader properties along the classloader hierachy. For example, an attacker can send such parameters, e.g. class.classLoader.delegateMode=true/false, to turn on/off the delegationMode of the classloader which can cause an DOS effect on the application. To prevent this from happening, any parameters with "class.classLoader" pattern should be excluded from the binding properties created in the current method.