java - Does the ModelDriven interface poses a security explot in struts2? -

background: coded struts2 actionsupport class modeldriven. it's hibernate/spring web app, using osiv , attached entities in view (jsp).

i received email today architect 'punishing' me putting object had reference attached entity on struts2 valuestack via modeldriven<e> interface. correct or what? obviously, serious thing doing not following saying, , don't feel taking offer , visiting him @ desk after this. oh boy. time change careers.

--- architect ---

billy, discussed, still making same mistakes in code on , on again. forth time have made error , i'm concerned quality of work. it's 1 thing make once or twice, after forth time, wondering if unable comprehend saying. following spell out you. if don't after reading email, come desk , we'll go on it. has stop immediately, , want code refactored before end of day correcting mistake. if code bleeds production, we'll have serious security problem on our hands. note copying dave on proper reprimand can issued. going recommend dave moved level iii level ii developer. read following , please learn it, , refactor code i've indicated.

about binding objects:

when struts2 action class marked modeldriven interface, model bound form elements in html page. example, if html form has field called username , action class defined as:

public class useraction extends actionsupport implements modeldriven

and usermodel pojo follows:

public class usermodel {   private string username;    public string getusername() {       return username;   }    public void setusername(string username) {        this.username = username;   } } 

when form submitted, long action contains instance of usermodel, struts2 bind field username usermodel.username, automagically populating value.

this simplicity has high cost malicious users, however. if object declared modeldriven, end-user, browsing user is, has access models graph via models setters. take case example:

public class useraction extends actionsupport implements modeldriven

and...

public class usermodel {   private string username;   private userentity userentity;    public string getusername() {       return username;   }    public void setusername(string username) {        this.username = username;   }    pubic userentity getuserentity() {       return userentity;   } } 

and...

@entity public class userentity {     private string password;      public string getpassword() {         return password;     }      public void setpassword(string password) {         this.password = password;     }  } 

assuming osiv pattern being used, , entity userentity attached.

a crafty user bit of fore knowledge or time on hands may:

/myform?username=billy&userentity.password=newpassword 

assuming entity saved @ end of session, above results in changing billy's password.

the point is, object graph available!

when using modeldriven, , using alternative horrible approach, must define fine grained models placed on valuestack, , copy model target object before sending response , allowing transaction commit.

your architect right, putting objects access sensitive information on valuestack poses potential security risk. malicious user indeed reset password above attack.

but:

since architect should have designed ways proper validation/restriction of input parameters. using paramsinterceptor in struts2 it's easy allow specific parameters passed action. thus, it's not work sucks, it's system's architecture. developers should able focus on implementing business logic. infrastructure must provided architect.

cheers,

w