<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Blog &#187; security</title>
	<atom:link href="http://www.adamcrume.com/blog/archive/tag/security/feed" rel="self" type="application/rss+xml" />
	<link>http://www.adamcrume.com/blog</link>
	<description></description>
	<lastBuildDate>Thu, 12 Jan 2012 15:54:08 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Struts 2 insecure direct object reference &#8211; part 2 &#8211; ParameterNameAware</title>
		<link>http://www.adamcrume.com/blog/archive/2010/01/23/struts-2-insecure-direct-object-reference-part-2-parameternameaware</link>
		<comments>http://www.adamcrume.com/blog/archive/2010/01/23/struts-2-insecure-direct-object-reference-part-2-parameternameaware#comments</comments>
		<pubDate>Sun, 24 Jan 2010 03:39:26 +0000</pubDate>
		<dc:creator>adam</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[struts]]></category>
		<category><![CDATA[struts2]]></category>

		<guid isPermaLink="false">http://localhost/blog/?p=57</guid>
		<description><![CDATA[
I discussed security issues in a previous post regarding malicious HTTP request parameters injecting data into a Struts 2 application.  Jon pointed out an interface I had forgotten about, ParameterNameAware.
How this works is quite simple.  Your action class implements ParameterNameAware, and in the acceptableParameterName(String parameterName) method, you return true only if the client [...]]]></description>
		<wfw:commentRss>http://www.adamcrume.com/blog/archive/2010/01/23/struts-2-insecure-direct-object-reference-part-2-parameternameaware/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Struts 2 insecure direct object reference</title>
		<link>http://www.adamcrume.com/blog/archive/2010/01/04/struts-2-insecure-direct-object-reference</link>
		<comments>http://www.adamcrume.com/blog/archive/2010/01/04/struts-2-insecure-direct-object-reference#comments</comments>
		<pubDate>Mon, 04 Jan 2010 22:49:21 +0000</pubDate>
		<dc:creator>adam</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[struts]]></category>
		<category><![CDATA[struts2]]></category>

		<guid isPermaLink="false">http://localhost/blog/?p=55</guid>
		<description><![CDATA[
There is a type of vulnerability which seems peculiar to Struts 2/WebWork applications and therefore may not be widely known. (It may exist in other frameworks as well, but I haven&#8217;t personally used any that have it.) The vulnerability is not part of Struts 2, but it enables it in the same sense that a [...]]]></description>
		<wfw:commentRss>http://www.adamcrume.com/blog/archive/2010/01/04/struts-2-insecure-direct-object-reference/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

