This repository was archived by the owner on Jan 30, 2019. It is now read-only.

This repository was archived by the owner on Jan 30, 2019. It is now read-only.

[sec] Attacker could load own helpset #36

Open

Assignees

Labels

Priority: MajorType: Bug

opened

on Jan 27, 2012

javax.help.tagext.ValidateTag allows to provide the url to the hsName by a reqeust parameter, if no hsName is provided in the code an attacker could provide a link to some helpSet he controls and load it into any website.
The request parameter helpset has to be validated before using it.

to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

glassfishrobot

Labels

Priority: MajorType: Bug

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests