[Springframework-developer] Request parameter binding enhancement request

[Rob B. <rob...@ve...>]

As someone points out in this thread
http://www.theserverside.com/news/thread.jsp?thread_id=23749 
using data binding for web request parameters potentially allows for unintentional "sets" on an object. 

I recommend Springs request binding code be enhanced to safegaurd this vulnerability.

Update DataBinder to have two new sets of methods:

public void setAllowedFields(String[]);
public String [] getAllowedFields();
public void setDisallowedFields(String []);
public String [] getDisallowedFields();


Optionally, modify the bind method to return a boolean.  bind(..) returns true if an attempt was made to call a setter which was not allowed.

Then implement the following logic.

if allowedFields == null && disallowedFields == null
	Do processing as spring does now.

if allowedFields != null && disallowedFields == null
	Only call setters for allowed fields.  Attempts
	to call setter on a non-allowed field cause bind(...)
        to return true

if allowedFields != null && disallowedFields != null
	only call setters for allowedFields, and not for
        disallowedFields attempts to call setter on a
        non-allowed field cause bind(...) to return true
	- alternate throw exception as allowedFields &
          disallowedFields cannot both be used

if allowedFields == null && disallowedFields != null
	call setters for any parameter except those disallowed.
        attempts to call setter on a disallowed fields cause
        bind(...) to return true

The purpose of having bind(...) return true is that we may want to let the request succeed (thus can't throw exception), but to log information about the request (remote IP, username, all request parameters, etc.) to use in analysis later to determine if someone was attempting to hack the application.

Other code (like ServletRequestDataBinder) should be modified to expose these new capabilities.  For example, change (or add another) constructor to ServletRequestDataBinder which has a parameter list like (Object target, String name, String[] required, String[] allowed, String[] disallowed) and have its bind method return a boolean too.

Later
Rob