Details

    • Type: Bug
    • Status: Closed
    • Priority: Minor
    • Resolution: Inactive
    • Affects Version/s: 5.2.3
    • Fix Version/s: None
    • Labels:
      None
    • Environment:
      Tomcat 6.0.18 + Liferay 5.2.3
      (Linux kernel 2.6.31-14-server)

      Description

      It is possible to make a special crafted URL that invokes Portlet Requests looping.

      Example URL:

      https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view

      catalina.out:

      18:16:30,546 ERROR [PortletRequestProcessor:377] Remote address 127.0.0.1
      18:16:30,547 ERROR [PortletRequestProcessor:379] Invalid path was requested 1
      18:16:30,789 ERROR [RequestProcessor:676] Invalid path was requested 1
      18:16:30,790 ERROR [PortletRequestProcessor:374] User ID null
      18:16:30,791 ERROR [PortletRequestProcessor:375] Current URL /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:30,791 ERROR [PortletRequestProcessor:376] Referer https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:30,792 ERROR [PortletRequestProcessor:377] Remote address 127.0.0.1
      18:16:30,792 ERROR [PortletRequestProcessor:379] Invalid path was requested 1
      18:16:30,860 ERROR [RequestProcessor:676] Invalid path was requested 1
      18:16:30,861 ERROR [PortletRequestProcessor:374] User ID null
      18:16:30,862 ERROR [PortletRequestProcessor:375] Current URL /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:30,863 ERROR [PortletRequestProcessor:376] Referer https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:30,864 ERROR [PortletRequestProcessor:377] Remote address 127.0.0.1
      18:16:30,865 ERROR [PortletRequestProcessor:379] Invalid path was requested 1
      18:16:31,114 ERROR [RequestProcessor:676] Invalid path was requested 1
      18:16:31,115 ERROR [PortletRequestProcessor:374] User ID null
      18:16:31,116 ERROR [PortletRequestProcessor:375] Current URL /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:31,116 ERROR [PortletRequestProcessor:376] Referer https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:31,117 ERROR [PortletRequestProcessor:377] Remote address 127.0.0.1
      18:16:31,117 ERROR [PortletRequestProcessor:379] Invalid path was requested 1
      18:16:31,126 ERROR [RequestProcessor:676] Invalid path was requested 1
      18:16:31,128 ERROR [PortletRequestProcessor:374] User ID null
      18:16:31,128 ERROR [PortletRequestProcessor:375] Current URL /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:31,129 ERROR [PortletRequestProcessor:376] Referer https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:31,130 ERROR [PortletRequestProcessor:377] Remote address 127.0.0.1
      18:16:31,131 ERROR [PortletRequestProcessor:379] Invalid path was requested 1
      18:16:31,368 ERROR [RequestProcessor:676] Invalid path was requested 1
      18:16:31,369 ERROR [PortletRequestProcessor:374] User ID null
      18:16:31,370 ERROR [PortletRequestProcessor:375] Current URL /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view
      18:16:31,370 ERROR [PortletRequestProcessor:376] Referer https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view

      reverse apache log:

      89.173.52.13 - - [02/Nov/2009:19:19:17 +0100] "GET /c HTTP/1.1" 302 373 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:17 +0100] "GET /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view HTTP/1.1" 404 890 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:17 +0100] "GET /c HTTP/1.1" 302 373 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:17 +0100] "GET /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view HTTP/1.1" 404 890 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:17 +0100] "GET /c HTTP/1.1" 302 373 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:18 +0100] "GET /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view HTTP/1.1" 404 890 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:18 +0100] "GET /c HTTP/1.1" 302 373 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:18 +0100] "GET /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view HTTP/1.1" 404 890 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:18 +0100] "GET /c HTTP/1.1" 302 373 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:18 +0100] "GET /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view HTTP/1.1" 404 890 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:18 +0100] "GET /c HTTP/1.1" 302 373 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"
      89.173.52.13 - - [02/Nov/2009:19:19:18 +0100] "GET /?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view HTTP/1.1" 404 890 "https://www.nethemba.com/?p_p_state=maximized&p_p_lifecycle=1&p_p_id=77&_77_struts_action=1&p_p_mode=view" "Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091028 Ubuntu/9.10 (karmic) Firefox/3.5.4"

      It seems to be a problem Portlet Request Processor.

        Attachments

          Activity

            People

            • Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Days since last comment:
                3 years, 32 weeks, 5 days ago