[WW-4620] ParametersInterceptor should check collection index to against DOS

• Type: Improvement
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 2.5.5
• Component/s: Core Interceptors
• Assignee: Unassigned
• Reporter: Yanming Zhou
• Created: 25/Mar/16 09:44
• Updated: 15/Jan/18 15:49
• Resolved: 30/Aug/16 06:36

Description

https://dzone.com/articles/spring-initbinder-for-handling-large-list-of-java

This is my workaround:

import org.apache.commons.lang3.StringUtils;

import com.opensymphony.xwork2.interceptor.ParametersInterceptor;
import com.opensymphony.xwork2.util.logging.Logger;
import com.opensymphony.xwork2.util.logging.LoggerFactory;

public class ParamsInterceptor extends ParametersInterceptor {

	private static final Logger LOG = LoggerFactory.getLogger(ParametersInterceptor.class);

	protected int autoGrowCollectionLimit = 255;

	public void setAutoGrowCollectionLimit(int autoGrowCollectionLimit) {
		this.autoGrowCollectionLimit = autoGrowCollectionLimit;
	}

	@Override
	protected boolean acceptableName(String name) {
		boolean b = super.acceptableName(name);
		if (b) {
			int start = name.indexOf('[');
			while (start > 0) {
				int end = name.indexOf(']', start);
				if (end < 0)
					break;
				String s = name.substring(start + 1, end);
				if (StringUtils.isNumeric(s)) {
					int index = Integer.valueOf(s);
					if (index > autoGrowCollectionLimit) {
						LOG.warn("Parameter \"#0\" exceed max index: [#1]", name, autoGrowCollectionLimit);
						return false;
					}
				}
				start = name.indexOf('[', end);
			}
		}
		return b;
	}

}

Issue Links

• relates to: WW-4909 List of Boolean is not populated in Action class
• links to: GitHub Pull Request #105