Anyone can log anything to your log using a URL (using direct action class AjaxRemoteLogging)

[hugithordarson]

See:

wonder/Frameworks/Ajax/Ajax/Sources/er/ajax/AjaxRemoteLogging.java

Lines 80 to 113 in 11e2f35

	public static class Log extends ERXDirectAction {
	public Log(WORequest r) {
	super(r);
	}
	@Override
	public WOActionResults performActionNamed(String logger) {
	String level = context().request().stringFormValueForKey("l");
	String msg = context().request().stringFormValueForKey("m");
	if (logger == null) {
	logger = AjaxRemoteLogging.class.getSimpleName();
	}
	// trigger session loading if present
	WOSession existing = existingSession();
	Logger log = Logger.getLogger(logger);
	if ("fatal".equalsIgnoreCase(level)) {
	log.fatal(msg);
	}
	else if ("error".equalsIgnoreCase(level)) {
	log.error(msg);
	}
	else if ("warn".equalsIgnoreCase(level)) {
	log.warn(msg);
	}
	else if ("info".equalsIgnoreCase(level)) {
	log.info(msg);
	}
	else if ("debug".equalsIgnoreCase(level)) {
	log.debug(msg);
	}
	return new ERXResponse();
	}
	}

Just flagging. Is this uh … normal? Unless I'm mistaken, anyone can log anything to any logger at any level in your app using a URL?

http://some.server.com/Apps/WebObjects/App.woa/wa/AjaxRemoteLogging$Log/er.extensions.appserver.ERXApplication?l=ERROR&m=BOOM!

[spelletier]

That seems odd, especially with the code that ask an existing session but does nothing with it. Maybe the initial idea was to allow only if an existing session is returned...
Line 94: WOSession existing = existingSession();

BTW, AjaxRemoteLogging is something I just discovered. The idea has something interesting but this implementation seems dangerous. I would at least add an if to enable it only with existing session.

[nullterminated]

Oh boy :) We should probably make that default to OFF and only enable it with a property or something. Anyone could kill the server just by filling up all the disk space.

[paulhoadley]

You've got to be kidding me. Can I prevent creation of the direct action class at the application level to block this?

[nullterminated]

I'm going to make this disabled by default in wonder8. It will only be on in development mode or if you turn it on with a property.

c127313