1. #1
    Sencha User
    Join Date
    Mar 2010
    Posts
    3
    Vote Rating
    1
    remento is on a distinguished road

      0  

    Exclamation Possible security issue with ColdFusion sever side sample code

    Possible security issue with ColdFusion sever side sample code


    I am new to Ext’s Direct functionality and was looking over the server side code for ColdFusion that is available with Ext 3.3 download. I may be misunderstanding the sample code but it looks like it contains a security issue that could expose private information and allow data to be altered in unintended ways, all without authentication.

    It looks like the Router.cfm file will call any component and method specified by the client and return the result. This looks like a security issue as methods that were not remotely accessible before, now are.

    ColdFusion remotely accessible methods have an “access” attribute that needs to be set to “remote” to run. However, because they are now called by Router.cfm and Direct.cfc, this built in security mechanism is neutered.

    It might be wise to consider checking the access attribute of the components method before allowing a method be called.

  2. #2
    Sencha - Architect Dev Team aconran's Avatar
    Join Date
    Mar 2007
    Posts
    9,358
    Vote Rating
    127
    aconran is a splendid one to behold aconran is a splendid one to behold aconran is a splendid one to behold aconran is a splendid one to behold aconran is a splendid one to behold aconran is a splendid one to behold aconran is a splendid one to behold

      0  

    Default


    remento - Thanks for the concern, the latest version checks simply to see if the ExtDirect attribute is set to true or yes.

    https://github.com/aconran/DirectCFM
    Aaron Conran
    @aconran
    Sencha Architect Development Team

Similar Threads

  1. Replies: 34
    Last Post: 20 Aug 2014, 11:49 AM
  2. DirectCFM: A ColdFusion Server-side Stack
    By aconran in forum Ext.Direct
    Replies: 36
    Last Post: 1 Mar 2014, 9:46 AM
  3. Where can I find desktop sample code
    By jgpandit in forum Ext GWT: Discussion
    Replies: 0
    Last Post: 16 Jul 2009, 6:15 PM
  4. Code Security
    By tBSTAR in forum Community Discussion
    Replies: 5
    Last Post: 4 Jul 2008, 7:03 PM

Thread Participants: 1

Tags for this Thread