[XW-146] Security issue due to parameter names being evaluated

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.0-beta2
• Fix Version/s: 1.0
• Component/s: Interceptors
• Assignee: Unassigned
• Reporter: John Patterson
• Created: 18/Dec/03 10:40
• Updated: 28/Dec/03 22:38
• Resolved: 28/Dec/03 22:38

Description

The ParametersInterceptor evaluates all parameter names using OGNL. This allows an attacker to execute code such as

@System@exit(1).dummy