javaserverfaces
  1. javaserverfaces
  2. JAVASERVERFACES-2652 Verify Implementation of JAVASERVERFACES_SPEC_PUBLIC-869 CSRF protection
  3. JAVASERVERFACES-2650

RestoreViewPhase.maybeTakeProtectedviewAction(): make it so "referer" local variable can always be passed to the ctor of URI

    Details

    • Type: Sub-task Sub-task
    • Status: Closed
    • Priority: Critical Critical
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.2.0-m12
    • Component/s: lifecycle
    • Labels:
      None

      Description

      There is some commented out code in this method. Correct it and un-comment it.

      if (!refererIsInProtectedSet) {
      // boolean isAbsoluteURI = referer.matches("^[a-z]+://.*");
      // if (!isAbsoluteURI)

      { // // PENDING real implementation must make the value of // // referer suitable for passing to the ctor for URI() // }

        Issue Links

          Activity

          Hide
          rogerk added a comment -

          Sending jsf-ri/src/main/java/com/sun/faces/lifecycle/RestoreViewPhase.java
          Sending test/agnostic/lifecycle/csrf/src/test/java/com/sun/faces/test/agnostic/lifeycle/csrf/Spec869IT.java
          Transmitting file data ..
          Committed revision 11753.

          Show
          rogerk added a comment - Sending jsf-ri/src/main/java/com/sun/faces/lifecycle/RestoreViewPhase.java Sending test/agnostic/lifecycle/csrf/src/test/java/com/sun/faces/test/agnostic/lifeycle/csrf/Spec869IT.java Transmitting file data .. Committed revision 11753.
          Hide
          rogerk added a comment -

          Committed.

          Show
          rogerk added a comment - Committed.

            People

            • Assignee:
              rogerk
              Reporter:
              Ed Burns
            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - 2 days
                2d
                Remaining:
                Remaining Estimate - 2 days
                2d
                Logged:
                Time Spent - Not Specified
                Not Specified