Think about implementing a web application that relies several secrets like anti CRSRF tokens, random seeds used for password generation and so on...
If the implementation is based on Spring MVC framework and security is important for you, then you should consider reading the paper Expression Language Injection which is the result of a joint research conducted by Stefano Di Paola of Minded Security and Arshan Dabirsiaghi of Aspect Security.
We tried to identify the security impact of a bug in Spring MVC which could lead to double evaluation of Expression Language if an untrusted input is used as the argument of particular attributes.
The research shows that it could result in the exposition of application information which should be kept bounded to the application.
The only information which seems to be still protected is tied to static values and static methods.
If you're interested, enjoy the reading and let us know your impressions.
Monday, September 12, 2011
Subscribe to:
Posts
(
Atom
)