Search code examples
struts2struts2-spring-plugin

Struts2 serious security issue?


I'm working with struts2, hibernate and spring and using model driven pattern. It seems that there is a serious issue when trying to fetch an object with 2 different users and sessions (also different computers) at the same time exactly.

More info... Let's say we have a Project object which has 2 members - user and name. Both users will try to fetch their Project object (which is a different object for different user of course). So User A would have a project with id 498 and User B would have a project with ID 499.

The struts action would recognize that they're trying to fetch an object with different ID but it seems that both of the users have the same Project object instance and therefore they see the same result. You could see in the log provided here:

2011-12-08 14:07:21 LoginInterceptor [INFO] User 17 is invoking populateProject, params: id=499 2011-12-08 14:07:21 LoginInterceptor [INFO] User 4 is invoking populateProject, params: id=498 2011-12-08 14:07:21 ProjectAction [INFO] Obj: hbn.Project@e2df60d, Session User Id is 17, obj.user.id is 4 2011-12-08 14:07:21 ProjectAction [INFO] Obj: hbn.Project@e2df60d, Session User Id is 4, obj.user.id is 4

How could I solve it?

Thanks, Ron.


Solution

  • As per discussion we have i am posting the cause of the problem and solution. The scope was not set for the action being created by spring plugin and by default they have a scope of singleton. In struts2 each action also work as a domain object so Struts2 always create a new instance of an action per request and place it on value stack.

    in above case scope was singleton and which was the cause of problem since both user have same action object being passed by the spring due to singleton scope .Setting scope=prototype solved problem

    for more details refer the official plugin page

    Struts2-Spring plugin