Details
-
Type:
Bug
-
Status: Closed
-
Priority:
Major
-
Resolution: Duplicate
-
Affects Version/s: 1.8.2a
-
Fix Version/s: 1.8.2-EE-GA_P01, 1.8.3
-
Component/s: Framework
-
Labels:None
-
Environment:ICEfaces
-
Assignee Priority:P2
Description
Using the ice.session extracted from the page:
curl --cookie /tmp/cookies.txt --cookie-jar /tmp/cookies.txt --data "ice.view=<SCrIPT>alert("SIdg96pCgjo1SnsmlAeEF50N6fkZGG")</SCrIPT>&ice.session=XQWAa3fjHI0pQN5VhZIfSw" http://localhost:8080/auctionMonitor/block/send-receive-updates
we see the malformed viewNumber echoed in the response:
<reload view="<SCrIPT>alert(SIdg96pCgjo1SnsmlAeEF50N6fkZGG)</SCrIPT>"/>
Activity
| Field | Original Value | New Value |
|---|---|---|
| Salesforce Case | [5007000000Aq9j6] | |
| Description |
Using the ice.session extracted from the page: curl --cookie /tmp/cookies.txt --cookie-jar /tmp/cookies.txt --data "ice.view=<SCrIPT>alert("SIdg96pCgjo1SnsmlAeEF50N6fkZGG")</SCrIPT>&ice.session=XQWAa3fjHI0pQN5VhZIfSw" http://localhost:8080/auctionMonitor/block/send-receive-updates we see the malformed viewNumber echoed in the response: <reload view="<SCrIPT>alert(SIdg96pCgjo1SnsmlAeEF50N6fkZGG)</SCrIPT>"/> |
Using the ice.session extracted from the page: curl --cookie /tmp/cookies.txt --cookie-jar /tmp/cookies.txt --data "ice.view=<SCrIPT>alert("SIdg96pCgjo1SnsmlAeEF50N6fkZGG")</SCrIPT>&ice.session=XQWAa3fjHI0pQN5VhZIfSw" http://localhost:8080/auctionMonitor/block/send-receive-updates we see the malformed viewNumber echoed in the response: <reload view="<SCrIPT>alert(SIdg96pCgjo1SnsmlAeEF50N6fkZGG)</SCrIPT>"/> |
To create fake ICEfaces requests using curl:
curl --cookie /tmp/cookies.txt --cookie-jar /tmp/cookies.txt http://localhost:8080/auctionMonitor/auctionMonitor.iface | fgrep session
Then extract the "session:" parameter and use in the request above for "ice.session".
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #20668 | Tue Feb 16 15:01:25 MST 2010 | ted.goddard | check for integer before echoing viewNumber ( |
| Files Changed | ||||
MODIFY
/icefaces/trunk/icefaces/core/src/com/icesoft/faces/webapp/http/core/ReceiveSendUpdates.java
|
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #20679 | Wed Feb 17 11:10:40 MST 2010 | ted.goddard | check for integer before echoing viewNumber ( |
| Files Changed | ||||
|
MODIFY
/icefaces/scratchpads/sf-8941/icefaces/core/src/com/icesoft/faces/webapp/http/core/ReceiveSendUpdates.java
|
| Fix Version/s | 1.8.2-EE-GA_P01 [ 10220 ] | |
| Fix Version/s | 1.8.3 [ 10211 ] |
Assigning to Mircea to review Ted's suggested fix and apply or adjust as required.
| Assignee Priority | P2 | |
| Assignee | Mircea Toma [ mircea.toma ] |
| Repository | Revision | Date | User | Message |
| ICEsoft Public SVN Repository | #20924 | Wed Mar 10 15:47:11 MST 2010 | ted.goddard | reverting since previous fix was sufficient ( |
| Files Changed | ||||
|
MODIFY
/icefaces/trunk/icefaces/core/src/com/icesoft/faces/webapp/http/core/ReceiveSendUpdates.java
|
The view number is already checked at line 62 in ReceiveSendUpdates.java file. It was implemented already for ICE-5181. Were the fixes for ICE-5181 not working all this time?
Sending back a session expired when view number is not correct is a bit misleading. A 500 error is more appropriate since it describes more appropriately the problem, also the response will shutdown only the bridge instance (window) that made the erroneous request while a session expired message will shutdown all the windows.
As Mircea pointed out, this was already fixed in the trunk but was reported by the customer since the fix was not present in ICEfaces 1.8.2. The change has been reverted.
Duplicate of ICE-5181.
| Status | Open [ 1 ] | Closed [ 6 ] |
| Resolution | Duplicate [ 3 ] |
Candidate fix:
Index: core/src/com/icesoft/faces/webapp/http/core/ReceiveSendUpdates.java
===================================================================
— core/src/com/icesoft/faces/webapp/http/core/ReceiveSendUpdates.java (revision 20655)
+++ core/src/com/icesoft/faces/webapp/http/core/ReceiveSendUpdates.java (working copy)
@@ -61,7 +61,13 @@
} else {
View view = (View) views.get(viewNumber);
if (view == null) {
+ try { + Integer.parseInt(viewNumber); + request.respondWith(new ReloadResponse(viewNumber)); + }
catch (NumberFormatException e)
{ + LOG.warn("Malformed viewNumber " + viewNumber); + request.respondWith(SessionExpiredResponse.Handler); + }} else {
try {
view.processPostback(request);