Question concerning login.jsp

[Cantor, Scott]

On 4/29/13 12:54 PM, "Brewer, Edward L" <lee.brewer at Vanderbilt.Edu> wrote:

>Alarm away.  That is the reason I posted here before I went live in
>production.  I am a little confused on how someone can exploit this
>however (maybe from my lack of html scripting experience).  Are you
>saying that someone could send a parameter that was crafted as a script
>that would be run on the server side?

Has nothing to do with scripting. You're using a parameter, so all I have
to do is build a link to your page with an actionUrl parameter pointing to
my server. You essentially are doing my phishing for me, I don't have to
even reproduce your page.

>   If so what would stop them from doing that on login.jsp?  Is the
>reason because actionUrl is gotten through request.getAttribute vice
>request.getParameter.

Yes. That's a very significant difference.

-- Scott