[sec] Attacker could load own helpset #36

Activity

1. glassfishrobot commented on Jan 27, 2012

   

   glassfishrobot

   on Jan 27, 2012

   ContributorAuthor

   More actions

   Reported by hme
2. glassfishrobot commented on Jan 27, 2012

   

   glassfishrobot

   on Jan 27, 2012

   ContributorAuthor

   More actions

   hme said:
   Sorry this is wrong, because of an other bug or strange code it is not possible to provide a helpset with an URL other than the URL from the request. An attacker has to change the request URL to something he controls.

   In createHelpSet() in javax.help.tagext.ValidateTag at first there is this check:

   if (!hsName.startsWith("/")) {
   	    hsName = "/" + hsName;
   	}
   

   This adds an "/" at the beginning if there is non, so this if is never true:

   if (hsName.startsWith("http")) {
   		url = new URL (hsName);
   	    } else {
   		url = new URL(request.getScheme(),
   			      request.getServerName(),
   			      request.getServerPort(),
   			      hsName);
   	    }
   
3. glassfishrobot commented on Apr 26, 2017

   

   glassfishrobot

   on Apr 26, 2017

   ContributorAuthor

   More actions

   This issue was imported from java.net JIRA JAVAHELP-36
4. glassfishrobot

   added

   Type: Bug

   Priority: Major

   on Apr 26, 2017
5. glassfishrobot

   self-assigned this

   on Apr 26, 2017