Popular Vulnerable Code

Renting

Though beauty gives you a weird sense of entitlement,it’s rather frightening and threatening to have others ascribe such importance to something you know you’re just renting for a while.
- Candice Bergen

*** Hint:  All chatUser properties are controlled by the user ***

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
<%@ page import="org.jivesoftware.smack.util.StringUtils"%> 
<%@ page import="org.jivesoftware.webchat.util.ParamUtils,java.util.*"%> 
<%@ page import="org.jivesoftware.webchat.actions.WorkgroupStatus" %> 
<!-- Get and Set Workgroup --> 
<jsp:useBean /> 
<jsp:setProperty property="*"/> 
<% 
    boolean authFailed = ParamUtils.getParameter(request, "authFailed") != null; 
 
    String location = (String)session.getAttribute("pageLocation"); 
    if (chatUser.hasSession()) { 
        chatUser.removeSession(); 
    } 
 
    String workgroup = chatUser.getWorkgroup(); 
    String chatID = chatUser.getChatID(); 
    if (chatID == null) { 
        chatID = StringUtils.randomString(10); 
    } 
 
    Workgroup chatWorkgroup = WorkgroupStatus.getWorkgroup(workgroup); 
    if (!chatWorkgroup.isAvailable()) { 
        response.sendRedirect("email/leave-a-message.jsp?workgroup=" + workgroup); 
        return; 
    } 
 
...<SNIP>...

<html> 
   <head> 
        <title>Information </title> 
 
        <link rel="stylesheet" 
              
               href="style.jsp?workgroup=<%= workgroup %>"/><script src="common.js">//Ignore</script> 
  </head> 
  <body style="margin-top:0px;margin-bottom:20px;margin-right:20px;margin-left:20px"> 
    <table width="100%" cellpadding="3" cellspacing="2"> 
    <tr><td colspan="2" height="1%"> 
    <img src="getimage?image=logo&workgroup=<%= workgroup %>"/> 
        </td> 
    </tr> 
      <form action="queue.jsp" method="post"> 
       <!-- Identify all hidden variables. All variables will be passed to the metadata router. 
            You can do any name-value pairing you like. Such as product=Jive Live Assistant. Such 
            data can be used to effectivly route to a particular queue within a workgroup. 
       --> 
        <input value="<%= workgroup %>"/> 
        <input value="<%= chatID %>" /> 
        <!-- End of Hidden Variable identifiers --> 
            <tr> 
                <td colspan="2" height="1%"> 
                <br/><%=  welcomeText %> 
               </td> 
            </tr> 
            <tr> 
              <td height="1%"> 
               <br/> 
              </td> 
            </tr> 
 
            <% if (authFailed) { %> 
           <tr valign="top"> 
               <td colspan="2"height="1%"nowrap><span>Authentication Failed</span></td> 
           </tr> 
            <% } %> 
 
            <% 
                       Iterator fields = workgroupForm.getFields(); 
                       while(fields.hasNext()){ 
                           hasElements = true; 
                           FormField field = (FormField)fields.next(); 
                           String label = field.getLabel(); 
                           boolean required = field.isRequired(); 
                           String requiredStr = required ? "&nbsp;<span class=\"error\">*</span>" : ""; 
                           if(!field.getType().equals(FormField.TYPE_HIDDEN)){ 
                   %> 
                   <tr valign="top"> 
                     <td height="1%"width="1%"nowrap><%= label%><%= requiredStr%></td><td><%= FormUtils.createAnswers(field, request)%></td> 
                   </tr> 
                   <% } } %> 
 
            <tr valign="top"> 
              <td height="1%"> 
              <!-- All workgroup defined variables --> 
                <% 
                       fields = workgroupForm.getFields(); 
                       while(fields.hasNext()){ 
                           FormField field = (FormField)fields.next(); 
                           if(field.getType().equals(FormField.TYPE_HIDDEN)){ 
                 %> 
                 <%= FormUtils.createDynamicField(field, request)%> 
                <% }} %> 
              <!-- End of Defined Variables --> 
 
                 <% // Handle page location 
                     if(location != null){ %> 
                     <input value="<%= location%>"/> 
                 <% } %> 
              </td> 
                <td><input value="<%= startButton%>"/></td> 
            </tr> 
            <tr> 
 
            </tr> 
           </form> 
          </table> 
 <div style="position:absolute;bottom:0px;right:5px"><img src="getimage?image=poweredby&workgroup=<%= workgroup %>"/></div> 
  </body> 
    <%if(!hasElements){ %> 
    <script> 
        document.f.submit(); 
    </script> 
    <%}%> 
</html> 
If you enjoyed this post,make sure you subscribe to my RSS feed!

1 comment to Renting

Leave a Reply

  

  

  

You can use these HTML tags

<a href=""title=""><abbr title=""><acronym title=""><b><blockquote cite=""><cite><code><del datetime=""><em><i><q cite=""><strike><strong><pre lang=""line=""escaped=""highlight="">