Uploaded image for project: 'Struts 2'
  1. Struts 2
  2. WW-4620

ParametersInterceptor should check collection index to against DOS

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.5.5
    • Component/s: Core Interceptors
    • Labels:
      None

      Description

      https://dzone.com/articles/spring-initbinder-for-handling-large-list-of-java

      This is my workaround:

      import org.apache.commons.lang3.StringUtils;
      
      import com.opensymphony.xwork2.interceptor.ParametersInterceptor;
      import com.opensymphony.xwork2.util.logging.Logger;
      import com.opensymphony.xwork2.util.logging.LoggerFactory;
      
      public class ParamsInterceptor extends ParametersInterceptor {
      
      	private static final Logger LOG = LoggerFactory.getLogger(ParametersInterceptor.class);
      
      	protected int autoGrowCollectionLimit = 255;
      
      	public void setAutoGrowCollectionLimit(int autoGrowCollectionLimit) {
      		this.autoGrowCollectionLimit = autoGrowCollectionLimit;
      	}
      
      	@Override
      	protected boolean acceptableName(String name) {
      		boolean b = super.acceptableName(name);
      		if (b) {
      			int start = name.indexOf('[');
      			while (start > 0) {
      				int end = name.indexOf(']', start);
      				if (end < 0)
      					break;
      				String s = name.substring(start + 1, end);
      				if (StringUtils.isNumeric(s)) {
      					int index = Integer.valueOf(s);
      					if (index > autoGrowCollectionLimit) {
      						LOG.warn("Parameter \"#0\" exceed max index: [#1]", name, autoGrowCollectionLimit);
      						return false;
      					}
      				}
      				start = name.indexOf('[', end);
      			}
      		}
      		return b;
      	}
      
      }
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                quaff Yanming Zhou
              • Votes:
                0 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: