securing blazeDS question

Hello

I'm working on an application using Grails + Flex. But after scanning by Rational to, the report shows that the application has some security issues like cross-site scripting, phishing through frames and link injection.

I realized that how does the AppScan is to manipulate the values of different fields of CommandMessage, RemotingMessage, messageId, clientId, Iddm, destination and so forth and look at the answer. For example, AppScan could insert ' alert (22193) < script > < /script > "messageId and if the response contains" alert (22193) < script > < /script > ', then he will report it to you as a problem of cross-site script.

I wonder if there is a solution to this, such as validation of these fields before sending to MessageBroker or simply returning error message in the response. Grateful if someone can help.

Kind regards

Haibin

Hi Haibin. IDS such as MessageId and Iddm can be defined by the customer. These are only the channels that are used to identify the client message, etc.. BlazeDS will normally produce UUID for the latter, but in some cases, developers can use ID they create themselves instead. The only condition to a point of view of BlazeDS is that the ID to be unique within the application. Because the IDS are simply treated as strings, I think it's a false positive reports of the tool being able to inject some scripts code in the field as a problem. It would be only a matter if the response has been made on the client and the script blocks are executed as is the case with HTML. This does not happen with the AUTHORITY and AMFX as what is sent across the wire is just data.

That said, it is probably possible to do validation on ID such as MessageID and Iddm if you wanted to. I would like to look at the BlazeDS documentation on processors of queue custom writing and writing custom adapters of e-mail. A custom queue processor where you then have access to each message in the queue outbound for each customer or a custom messaging adapter where you have access to all messages sent to a destination that uses the adapter of writing would probably be the best place to do this kind of check.

We do no checking of the ID format (we only care if the ID is a valid string) to move to a more recent version of BlazeDS will not help you.

Hope that helps.

-Alex

Tags: Adobe Open Source

Similar Questions

  • How reset my security if questions I do not remember the answers

    I do not remember all

    You have to ask Apple to reset your security questions. To do this, click here and choose a method; If this page does not list one for your country or if you are unable to call, complete and submit this form.

    (137396)

  • Secure area questions

    Hi BC community, I have a few questions Secure area that I need help:

    (1) is it possible to put an expiration of secure area date 30 days from the Date a shipment of form Secure area (via the secure payment area), without having to do it manually via the ADMIN of BC?

    (2) I have a customer who has 3 areas of Secure.  Each Secure area must have a basic text content shown.  The content is specific to this protected area.  Question - I know how to hide/show info Secure area based on the BC-0 {whoisloggedin} and {whoisloggedin} settings - 1, but is there a way to add an ID of the < div > tag to show only the content relevant to a specific area Secure ID?

    Thank you

    Aaron

    Hello

    You can put this in a form:

    Date - October 1, 2013

    There is currently no way to expose it that your request directly, BC in the live version of it has no area ID in the sense of what you use to. But you can look at to try to use:the Developer Reference

    (Javascript/css solution)

  • Shows the code from other sites to the top of my page. - Security Possible question

    I'm working on a Web page behind a firewall. I use firebug for firefox script debugger and the IE for IE script debugger. If I go to another site (cnn or reddit), then back to my test page, that there is an error in the code for drop down menu jquery that I wrote, rather than the advice that there is an error in jquery - 1.8.3.js, I get a notice that there is an error in the code on the previous page. For example http://www.redditstatic.com/reddit-init.en.IY9Adp1eOs.js will appear in the error console when I'm on my own test server.
    Given that the code on my page tries to run code from someone else, it seems to me that this could be a major security problem. It is perhaps difficult to understand. I have screen shots I try to load.
    Thank you
    Brita
    PS when I debug in IE. I show only the expected jQuery error.

    I rarely use Firebug, so I have not seen myself. Or simply ignored. I hope someone else here or on the list of Firebug/forum can address this problem.

  • Will be getting a gtx 770 - Secure Boot question/s

    I understand that secure boot must be disabled, but that I also need to enable legacy support?

    http://support.HP.com/us-en/document/c03975089

    Windows 8.1 - UEFI - friend 80.07 05/09/2013

    Hello:

    If you want to add a video card no HP, you must change both settings according to the instructions on the link below.

    http://support.HP.com/us-en/document/c03653200

  • Pavillion dv6 Wireless Security Configuration Question: router beats Notebook?

    I have a HP Pavilion dv6 Notebook running Windows 7 that I connect to a new router.

    The router offers a high security setting: WPA - PSK (TKIP) and WPA - PSK (AES).  My laptop does not show this as being available.

    It shows that of the two, but not both combined.

    Does anyone know if my laptop can provide this level of security setting so I can match my router?

    My cell phone as a card Intel Centrino Wireless N-1000.

    Thank you!

    Dear Dragon-fur,

    Thank you very much for your kind response and assistance.

    I used the AES as WPA - PSK (AES) parameter.

    However, it seems that a better level of security is available, at least on my router, which combines the AES parameter with the TKIP {WPA - PSK (TKIP)} parameter.  It shows like the WPA - PSK (AES) + WPA - PSK (TKIP).  My notebook, however, does not give this combo setting option.

    I'm misunderstanding you?

    Thank you very much!

    Chai613

  • Security IIS question - Blackberry Java program

    I'm really at a cross roads here, I have a Windows 2003 Standard Server, I need to make sure the user access the installation package for the phone is a member of our active directory, now the file is secured in IIS anonymous access disabled, authenticated access is set to 'Digetst of authentication for Windows domain servers' with the correct realm. The user can go to a site web page with internet explorer on a test computer and prompted for a login name, they put into their network and network password user name and authenticate OK and I know who they are. BUT on BlackBerry phones, any type of phone this is the case, when you are prompted, they put in the SAME EXACT INFORMATION and obtain unauthorized user, it's as if the phone cannot send or receive something. The IIS server has a valid SSL certificate until 2016 and a verisign certificate valid. Content expiration is dsabled. MIME types are correct for the deployment because program if I activate anonymous, anyone can install the program very well (which is not what I want, I'm not anonymous activated), I do not use any substance asp.net but this tab is set to the version 2.0.50272, which should have no effect on this problem. The directory is configured with read / access to the log and index this resource, it has its own pool of applications set to Scripts only, which is also very good.

    Why is it impossible with any configuration of browser on blackberries to authenticate?

    Well, let's say that you have described your problem now.

    I thought that you would say kerberos/ntlm authentication (which is similar, I read on the technet site).

    as far as I know the windows digest authentication is not supported on the blackberry browser, but do not hesitate to get this confirmed by your RIM support.

    Maybe you could go to with https basic authentication?

  • Secure API question

    Hello

    in my application, I use the API signed... I want to deploy the application on the device... while deploying, I need to sign these APIs... I signed these APIs

    When I try to start the application on the device, it is said: application startup error: attempt to access a secure API

    I've done all that is necessary to do to signed API

    no particular reason for this?

    Thanks in advacne.

    Clean.bat helped.

    Thank you

  • Another security.allowDomain() question

    I have a Flex application cause me a lot of grief because of the infamous * Security Sandbox Violation *.

    After having spent a few days in the doc/reference and help online, I hope someone here can give me an idea.

    OK, the swf files hosted on "DomainA', used of"DomainB"of a page.

    Calling JavaScript from DomainB to DomainA ending by:

    Security Sandbox Violation

    SecurityDomain ' http://domainB/1685555-02-01-01.m3u 'tried to access incompatible context' http://domainA/main.swf '

    Excerpt from Main.mxml, where the word is a character generic allowDomain:
    < mx:Application... preinitialize = "application1_preinitializeHandler (event)" >
    < mx:Script >
    <! [CDATA]
    ...
    protected function application1_preinitializeHandler(event:FlexEvent):void {}
    Security.allowDomain("*");
    ...
    }
    ...

    Now, from what I've seen, this should allow any field to access the SWF via javascript... but it's not.

    I have 2 things out of the ordinary, and perhaps the problem lies here:

    -DomainA and domanB are respectively 5 and 6 parts names (www.julien.devbox.okdown.com and static.julien.devbox.domain.co.uk)

    -The Main.swf uses 2 libraries, built separately, and there is no reference to security.allowDomain(), but really no doubt that this is necessary.

    Please, any ideas would be very welcome.

    Best regards

    Julien

    There must be code in a SWF file that calls the allowDomain to allow code in

    This SWF to call.  So, if you are using modules or apps or RSL, if

    code in the SWF files are a reminder, you must have the code in the SWF files

    calling allowDomain.  AllowDomain call from the code of the main application only

    help for the code in the main SWF file.

    There is a function on IFlexModuleFactory calling allowDomain on all

    the known modules and RSL.

  • security internet-question (possible pirates)

    Today I noticed my funny acting internet all of a sudden. When I opened a new page/tab that appears instead of my home pages regulars of google or bing.  I don't know who is this company or why it occurs, it seems to interfere with my internet - I'll be online and suddenly the internet starts acting funny and will not work.

    It is a login screen.

    Can someone tell me why this screen?  What is a hacker?  Who is doing this and why?  Any ideas anyone

    You can use 'force quit' in the dropdown under the Apple

    choose Safari (or other applications, for various reasons) so it

    stops. Then restart Safari, hold down the SHIFT key to the bottom of the browser both

    does not have any previous web saved pages.

    {The browser will remember and reload the same page, unless you choose

    to stop the charging; It is a method of software in the Mac. Another way

    would be to deny access to the internet; stop the Airport (an icon of antenna around)

    (Date et heure dans la fenêtre supérieure droite) or if the internet connection by cable, unplug Ethernet.}

    Without be defined on the start page, you should be able to go in Safari preferences

    and delete the history of the browser including cookies; Check the setting of the home page

    to see that he said that, too. This is part of a situation of Adware that can

    be serious, especially you above or below should react to the presence of evidence.

    After you change the preferences of Safari so do not load the bad page (s), a reboot of the

    Safari would be OK. My browsers don't load anything when I run one.

    • Safari open without restoring the tabs and windows - tip...

    www.chriswrites.com/Open--without-restoring-tabs-and-windows-quick-tip/safari

    "When you want to Open Safari without restoring tabs just hold down the SHIFT key .

  • Remove Security / difficult questions in IOM

    Hello
    I want to delete the IOM issues posed at the time of the first connection, I won't use it. What should I do for this?

    Thank you

    I don't have a Setup IMO I can return to easily, but iirc, the setting should be something like PCQ. FORCE_SET_QUESTIONS. There is another parameter named XL. ForcePasswordChangeAtFirstLogin in the case where you are interested in control of that.

    I hope this helps.

    -Vinod

  • Why Firefox remember social security numbers?

    I don't think it's normal, so I'm not sure if it's the fault of Firefox or failure of the Web site. I was just something on Paypal.com and when it came time to fill out my social security number, he had 'suggestions' pop-up in the fields with my SSN it call back before. Things like SS # and credit card, numbers not remember like that because it's a security important question for if someone else uses my computer.

    I don't want to disable fields remember entirely because this feature is useful for me. Names, addresses, phone numbers, emails, are going well to be auto-rempli, but not something extremely sensitive as SS #.

    Again, sorry if it's lack of Paypal. I will contact them instead if it is.

    Thank you for any information you can provide.

    Firefox has a built-in algorithm to check for credit card numbers (Luhn), but not for other privacy sensitive numbers.

  • My router is actually secure?

    I'm wondering if what follows what I've done is the best possible, if there is any means possible to improve security:

    I have a WRT320N

    • SSID: just let it spread. Delete this show will not improve the overal security. SSID will be shown even if you Devil shows periodic.
    • Change the default name of the router to something that leaves not hear it's location or name brand/type
    • change the default password (the one to access the router from your browser)
    • Disable remote management: don't want any person who uses a Wi - Fi connection to try to hack my router
    • Disable Upnp, the automatic configuration of the router has possible security leaks.
    • use WPA2 Personal (just choose the highest encryption) and using the combination of numbers and long, uppercase letter, tiny you can think off.
    • MAC filtering can be set on, but hackers can clone the MAC address, the extra security is questionable.
    • Isolation of the AP: prevent users from wi - fi on my router to access to eachother, isolate all users connection wi - fi to eachother.
    • turn on the SPI Firewall: blocks incoming network packets from the internet. And have not started by me: internet to port 80, my firefox tries to open a Web page, these type of incoming packets will be accepted by the router without the internet to my computer.
    • Use webfilter and prevent any network with proxy, java, activex package to switch my router: at this moment I'm block the proxy. I'm filtering the Web casts.
    • Block all ports except 20,21,25,53,80,110,443. (port range is 0 to 65523) Block protocols UDP and TCP for all IP 192.168.0 to 192.168.0.254 addresses so only the mentioned ports are allowed to use.

    Thanks for helping out.

    • Re SSID broadcast.

      1 correct. Even with the SSID broadcast disabled the router will still broadcast a recurring tag that means a wireless scanner will resume immediately the existence of a wireless network.

      2. the SSID is transferred in plain text in the connection with the router. A network sniffer will learn the SSID for the moment that a (legitimate) device connects to your network.

      3. by sending packets of thugs to the AP, it is easily possible to dissociate a connected wireless forcing a new association. This way you can learn the SSID immediately.

      1-3 means a SSID of the AP wireless with SSID broadcast disabled is unknown as long as no wireless device is connected to the router, because there is no way to force a link to a legitimate device demand. Some people believe so disabled SSID broadcasting is an important way for increased security, particularly when the wireless is not used very often. Of course, if you don't need the wireless for most of the time you need to turn off completely.

      However, to disable the SSID broadcast technically breaks the standard 802.11 standard and is known to cause problems of connectivity and stability with some wireless cards. Therefore, I usually recommend is not to disable the SSID broadcast.

    • Re "the router by default name". If you mean the SSID, of course, change is important. Especially to prevent your wireless devices to connect to the router of your neighbor who is using the default SSID.

      It is not necessary to change the name of "router" on the master installation. It is only necessary to connect internet and only if required by your ISP.

    Change the SSID or "router name" will not change the MAC address on the wireless. The first half of this MAC address will reveal the manufacturer (Linksys or Cisco)

  • Relative to the remote management. Disabling remote management is good. Of course, make sure that it really works. Some routers have a bug in the firmware that opened the web interface for the internet, regardless of this setting.
  • Re UPnP. Fix. It must be turned off at any time.
  • Re personal WPA2 with AES encryption only and a strong password is the best wireless security, you can have it right now. Password can be up to 63 characters.
  • Re wireless mac filtering: MAC addresses are always transferred unencrypted (with WPA2) and are easily cloned. So, a simple network sniffer is able to collect the MAC addresses of legitimate devices that you can use to connect.
  • Re of isolation AP can be used if no wireless - wireless connection is necessary. Of course, if an attacker has hacked your wireless network, it can try to hack your router here. The protection of the web interface of the side LAN is quite low.
  • SPI Firewall re. Must be enabled. This prevents the internet router.

  • What you write in this topic is protection"because of the NAT, or because you are using private IP addresses. NAT, technically, does not block unsolicited inbound traffic. It simply drops unsolicited inbound traffic because he doesn't know what to do with it, that is, he doesn't know where to deliver unless you configure port forwarding automatic or similar. By design, NAT is not a security mechanism as its design is intended to allow the connections, not to block them. Some implementations of (older) NAT tried to deliver inbound unsolicited by some heuristics. Some (older) NAT implementations have features to support FTP (to do FTP works fine through a NAT router) which led to any open port on the router.
  • Re webfilter: depends. Will cause problems with HTTPS web sites like HTTPS requires security to - end.
  • Re blocks all ports except 20,21,25,53,80,110,443. Well depends on once again. In your list, for example, you block the port 995 (POP3S) and accept only 110 (POP3). Depending on your e-mail client and the pop server, this can lead to a connection that is not encrypted between the client and the server because port 995 is not accessible. Similar with the port 25 (SMTP). Some web servers running on port 8080 or other ports that will not or only partially work (because some content is on a webserver with the different port number).

    Technically speaking, your block probably list more will affect you and your ability to use the more secure protocol which may be currently on your block list. In addition, as most of the people have ports 80 and 443 open for outgoing traffic most malware uses to talk to the outside. So your good list that the idea seems good probably won't help you.

    So I would say in most home networks such a blocking list based on a list of a few exempt ports will really not help your security and for the most part will cause problems for you and nothing else. Such a list will work in a business setting where you can refine the traffic authority very well. But to use domestic and general habits that it won't really work for navigation.

    In addition, I think that you can not set up such a list on a Linksys router. You can only block the ports, but not all ports except a few.

  • Another extremely important point missing from your list: always change the router password (admin) in a password strong. But I guess you already did this, too.
  • Overall, I would say that all you have reason...

  • scanner Security Windows live onecare, microsoft security databases

    How can I uninstall these programs? tried to add remove programs, but could not scan security remove or mse.

    http://OneCare.live.com/site/en-us/community/default.htm

    They will help you in the Acrobat Live Onecare community.

    Microsoft Security Essentials questions should be directed to the MSE Forums:

    http://social.answers.Microsoft.com/forums/en-us/msestart/threads

    Installation and upgrade of Microsoft Security Essentials program Forum at the link above.

    http://social.answers.Microsoft.com/forums/en-us/msescan/threads

    Analysis, detecting, and removing threats Forum at the link above

    http://social.answers.Microsoft.com/forums/en-us/mseupdate/threads

    Updating Virus and Spyware definitions Forum at the link above

    See you soon.

    Mick Murphy - Microsoft partner

  • ERROR CODE 0 X 080240022 SECURITY ESSENTIALS RUNNING VISTA HOME BASIC 32-BIT

    I GOT THIS PC A WHILE NOW AND IT IS A DELL VOSTRO 200, ILS HAVE ALREADY REPLACED THE MOTHERBOARD AND THE DRIVE IN OCTOBER LAST AND ME IT IS AS IF I HAD NOTHING ELSE THAT PROBLEMS AND THINGS KEEP RUIN, ALL MY TYPED OUT WORK REMOVES ITSSELF AS I AM TO FINISH IT, MY PRINTER KEEPS HAVING TO BE UNINSTALLED AND REINSTALLED , THE SCREEN KEEPS FREEZING UPWARDS, MY MOUSE STOP WORKING... I REPLACED AND NOW IT... A MICROSOFT LASER MOUSE DOES THE SAME THING - I COULD GO ON AND ON BUT MY CONCERN EVERYTHING AT THIS POINT IS I HAD ORIGINALLY BOTH WINDOWS DEFENDER AND ESSENTIALS AND THEY BOTH WORK. NOW DEFENDER DOSENT AND I WAS TOLD I HAVE NO NEED OF THE TWO (BY A MICROSOFT TECHNOLOGY). AND I'M STARTING TO HAVE PROBLEMS WITH THE UPDATE ESSENTIALS. I SCAN ALMOST DAILEY ON a CALENDAR AND THO ALL REPORTED AS BEING FINE I THINK NOT ASTODAY HE WATCHED AS SOME FOREIGNERS WRITE ON MY TYPED LETTERS. NOW WHAT?

    Microsoft Security Essentials has its own integrated version of the defender and it automatically disables the version of Vista in Windows Defender.

    If it's not:

    http://Windows.Microsoft.com/en-us/Windows-Vista/turn-Windows-Defender-on-or-off

    Turn Windows Defender on or off the information on the link above of Microsoft.

    Hope the foregoing explains the common compatibility issues with Windows Defender and MSE.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Microsoft Security Essentials questions should be directed to the MSE Forums:

    http://social.answers.Microsoft.com/forums/en-us/msescan/threads

    Analysis, detecting, and removing threats Forum at the link above

    http://social.answers.Microsoft.com/forums/en-us/mseupdate/threads

    Updating Virus and Spyware definitions Forum at the link above

    See you soon.

    Mick Murphy - Microsoft partner

Maybe you are looking for

  • change the pop-up list for all cells using this pop-up window

    I have a workbook of numbers more who uses the same large table pop up in almost every row in each sheet... How can I maintain the list of items on the global scale (in all occurrences)? Creating on the Mac to use it on all my devices. Thank you!

  • How to install module DSC without installing LabVIEW

    Hello. I build exe with the functions of the dsc module (I used an opc server). In my computer, it's work very well. Earlier, I want to create the installer for another computer. I have check all Inc. in the other installers. And build. I install my

  • What is the procedure using a flash drive to store the music files?

    Hello!, my OS is Windows XP Home Edition and I have a compaq presario pc.  I want to store music files in this sandisk 8.0 GB cruzer flash drive. I see this flash player needs to connect to my PC's USB port, but what do I do after having plugged the

  • How to apply disable a number of objects the same type property

    Hello I have 10 boxes of combination field in my VI. I want to disable these combinations field when I run this VI. I know how to make using the node property, but only for an object. If I do this I use 10 nodes property to turn off all the boxes in

  • It not install Power Shell 2.0 KB968930

    This update of windows fails during the installation or my computer crashes.  I tried to go to the previous restore points but I did it so many times, I can't find an earlier date to use it anymore. I use Windows Home Vista Premium 64 bit. Question 1