Uploaded image for project: 'RichFaces'
  1. RichFaces
  2. RF-3586

URLs of resources are not predictable

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Blocker
    • Resolution: Done
    • Affects Version/s: 3.1.4, 3.1.5, 3.2.0
    • Fix Version/s: 3.3.0
    • Component/s: None
    • Labels:
      None
    • Affects:
      Documentation (Ref Guide, User Guide, etc.)

      Description

      The way RichFaces generates URLs for the scripts and styles is incompatible with security restrictions in a corporate world.

      When applications are deployed in production, the list of the URLs it uses has to be known : the Firewalls are configured with this "white-list" and a "black-list" forbidding URLs with ".." characters.

      For instance the following URL has several problems :
      a4j_3_1_5.GAcss/table.xcss/DATB/eAF7P..bLgAIQwM..faces

      • The prefix "a4j_3_1_5.GA" can be configured, but usually the projects don't bother to do it, thus this part is gonna change with each RichFaces release
      • The part "eAF7P..bLgAIQwM." is unpredictable, it depends on the value of the object SkinImpl.hashcode() ?!!
      • The part "eAF7P..bLgAIQwM." contains ".."' characters

      Overall we had to bypass the usual security restrictions to put an application in production, this is unacceptable.

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  nbelaevski Nick Belaevski
                  Reporter:
                  olivier.martin Olivier Martin
                • Votes:
                  7 Vote for this issue
                  Watchers:
                  3 Start watching this issue

                  Dates

                  • Due:
                    Created:
                    Updated:
                    Resolved:

                    Time Tracking

                    Estimated:
                    Original Estimate - 1 day, 4 hours
                    1d 4h
                    Remaining:
                    Remaining Estimate - 1 day, 4 hours
                    1d 4h
                    Logged:
                    Time Spent - Not Specified
                    Not Specified