Spring velocity projects are vulnerable to injection exploits [SPR-9224]

[spring-projects-issues]

whyBish opened SPR-9224 and commented

http://forum.springsource.org/showthread.php?124077-Spring-WebMVC-Velocity-exploit

If an application uses spring-webmvc and a velocity view resolver and have used #springbind everywhere then html will be escaped but velocity will not.
Example exploit text:
#if(true)<stelocity!</strong>#rong>Vend

I can't find any info on how to velocity escape the input. Velocity itself doesn't seem to provide a velocity escaper (it provides html/sql etc). Does one exist or must a custom one be written?
The point to change would seem to be the #springbind definition in spring.vm

---

Affects: 3.1.1

Reference URL: http://forum.springsource.org/showthread.php?124077-Spring-WebMVC-Velocity-exploit

[spring-projects-issues]

Rossen Stoyanchev commented

Would you mind creating a sample project that demonstrates the exploit at the issues repo?

[spring-projects-issues]

whyBish commented

Sorry, not a defect. The template we were relying on is doing a velocity evaluate on unescaped input fields.

[spring-projects-issues]

Rossen Stoyanchev commented

Do you mean close the ticket or is it still an issue?

[spring-projects-issues]

Juergen Hoeller commented

Seems like an invalid issue then...