Remove danger of using a request parameter in a JSP:include

HI,
I have a basic include where the filename is controlled by a request parameter:
<%String fileName = request.getParameter("param1")+".jsp"; %>
<jsp:include page="<%=fileName%>" flush="true" />This works fine but I am rather worried about the security as some can easily edit the URL to something like this:
http://www.mysite.com/include.jsp?param1=../../../passwords
Does anyone have any good security techniques that would strip out anything in param1 that could potentially be rather dangerous?
Thanks

Check/test the request parameter before using. Best way is to use a (controller) servlet for this.

Similar Messages

Repeating parameter names in jsp:include

Hi,
I have this jsp code fragment:
<div>
<jsp:include page="fragment_1.jsp">
<jsp:param name="param" value="hello world!"/>
</jsp:include>
<jsp:include page="fragment_2.jsp">
<jsp:param name="param" value="good morning!"/>
</jsp:include>
</div>
When this code executes, the value for param, as the fragment_2 is included, is "hello world!" and not "good morning!".
How can I use the same name for a param in fragment_2 ?
Pietro

The problem is that nothing in the servlet specifications prohibits a requests from having more that one parameter with the same name. It looks that when you set a parameter with the jsp:param tag that it is appending another parameter with that name.

Using a URL parameter by the JSP to pull in an html file for dynamic content ??

I would like to have a simple jsp which could be called from an URL
          with a parameter. I'd like the parameter to be used by the JSP to form
          a filename of a second file. This second will be a chunk of HTML
          which is sucked in to the JSP to form some content in a particular
          HTML table cell.
          The ASP is this :
          <%
          targetPath = Server.MapPath(Request.QueryString("Content")+".txt")
          // makes a variable called targetpath which is a filename called
          something.txt
          Dim filesys, myloadedfile, line
          Set filesys = CreateObject("Scripting.FileSystemObject")
          Set myloadedfile = _
               filesys.OpenTextFile(targetPath,1,0)
          Do
          // loops round each line of the something.txt file putting them in the
          JSP
               line = myloadedfile.Readline
          %>
          <%=line%>
          <%
          Loop Until myloadedfile.AtEndOfStream
          myloadedfile.Close
          %>
          Please can someone help me out with some info on the JSP equivalent
          please?
          Thanks Heaps
          Rob


          See Content tag on http://www.servletsuite.com/jsp.htm
          This custom tag lets to add any file (even the outisde
          of your web application).
          [email protected] (rob) wrote:
          >I would like to have a simple jsp which could be called from an URL
          >with a parameter. I'd like the parameter to be used by the JSP to form
          > a filename of a second file. This second will be a chunk of HTML
          >which is sucked in to the JSP to form some content in a particular
          >HTML table cell.
          >
          >The ASP is this :
          >
          ><%
          >targetPath = Server.MapPath(Request.QueryString("Content")+".txt")
          >// makes a variable called targetpath which is a filename called
          >something.txt
          >
          >Dim filesys, myloadedfile, line
          >Set filesys = CreateObject("Scripting.FileSystemObject")
          >Set myloadedfile = _
          >     filesys.OpenTextFile(targetPath,1,0)
          >Do
          >// loops round each line of the something.txt file putting them in the
          >JSP
          >     line = myloadedfile.Readline
          >%>
          ><%=line%>
          ><%
          >Loop Until myloadedfile.AtEndOfStream
          >myloadedfile.Close
          >%>
          >
          >Please can someone help me out with some info on the JSP equivalent
          >please?
          >
          >Thanks Heaps
          >
          >Rob

Pass parameter to the jsp include

Hello,
Is it possible to pass a string to the <jsp:include page ?
Thanks!
~ Kyle

Use jsp:param.

Struts tag for request.setAttribute() in a jsp page

Hello All
Does anyone know struts tag that can be used for request.setAttribute() in a jsp page?
Thanx in advance.

Well
<bean:define id="foo" name="newsIdAttribute" scope="request" type="java.lang.String" />is equivalent to
<%
(java.lang.String) foo = (java.lang.String)request.getAttribute("newsIdAttribute");
%for setting bean properties you might have to use
<jsp:setProperty/> or <c:set/> tags in JSP / JSTL respectively.
Hope this might answer your question :)
REGARDS,
RaHuL

Reading POST-Request-Parameter-Values from WebDynPro now possible?

Hello,
in the past I always was disappointed that in WebDynPro there was no way to read POST-request-parameter-values directly after the call of a WebDynPro-Application.
The only (documented) way to read / transfer request-data into an WebDynPro-application was via "URL query string parameters" in the request URL.
The last week I forgot this restriction. I called my WebDynPro-application using a POST-Request-Parameter (cookie_guid) instead of an URL-parameter.
After noticing my mistake, I was really surprised that the WebDynPro could read / shows the the POST-Request-Value.
I didn't make any changes in the coding of my WebDynPro-Application (zvis_show_sso_cookie).
After this cognition I built the following simple HTML-formular to analyse the behavior of the WebyDynPro by calling it with an URL-Parameter (cookie_guid=Url-GUID) together with the POST-Parameter (cookie_guid = Post-Value-GUID).
After calling the WebyDynPro it reads / shows the "POST-Value" of the request !!!
(Remark: If I made a simple refresh or type directly the URL "http://hg10762.vis-extranet.de:1080/sap/bc/webdynpro/sap/zvis_show_sso_cookie?sap-language=DE&cookie_guid=Url-GUID" in the browser, the same webdynpro reads / shows the URL-Parameter-Value).
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
       "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
</head>
<body>
<form method="post" action="http://hg10762.vis-extranet.de:1080/sap/bc/webdynpro/sap/zvis_show_sso_cookie?sap-language=DE&cookie_guid=Url-GUID">
<table border="0" cellpadding="5" cellspacing="0" bgcolor="#E0E0E0">
    <tr>
      <td align="right">Cookie_GUID:</td>
      <td><input name="cookie_guid" type="text" size="30" maxlength="30" value="Post-Value-GUID"></td>
    </tr>
    <tr>
      <td>
        <input type="submit" value=" Absenden ">
        <input type="reset" value=" Abbrechen">
      </td>
    </tr>
</table>
</form>
</body>
</html>
My questions:
I there any documentation that describes the behavior of WebDynPro after calling it by using POST-Parameter values?
I believe in the past it wasn't possible to read POST-request-parameter-values in WD. Has SAP changed the functionality?
Is the behavior I described in my example above mandatory?
Regards
Steffen

As far as i know in general HTTP request GET method is standard but in SAP POST is standard. All the client request is passed as POST to the server in order to avoid the URL parameter length restriction in GET method.

How to pass request parameter to bounded task flow?

Hi, this is probably a simple question, but just not sure how this should be done. I have a .jspx that contains an ADF region for a bounded task flow. The task flow has a required input parameter, e.g. objectId. I want to be able to pass a request parameter that's sent into the .jspx page to the task flow. For example, Test.jspx?id=123 should pass 123 for the objectId input parameter of the task flow.
When adding the ADF region to the page, the Edit Task Flow Binding dialog prompted for a value for the objectId input parameter. I wasn't sure what I can put for the value so I just hard-coded something like 123 for now. So in the page definition file, sometihng like the following got added:
    <taskFlow id="testtaskflow1"
              taskFlowId="/WEB-INF/taskflow/test/test-task-flow.xml#test-task-flow"
              activation="deferred"
              xmlns="http://xmlns.oracle.com/adf/controller/binding">
      <parameters>
        <parameter id="objectId" value="123"/>
      </parameters>
    </taskFlow>I'm wondering is there some EL expression I can use for the parameter value that gets the value of the id request parameter passed into the .jspx? Thanks.

you have to use it like.. #{bean.idValue} and in the getter of the id Value use it like
private int idValue;
//setter
//getter
public int getIdValue(){
          HttpServletRequest request =
            (HttpServletRequest)FacesContext.getCurrentInstance().getExternalContext().getRequest();
        int id = request.getParameter("id");
       return id;
}

How to remove XML namespace in SOAP request

Hello
I would like to change one of our existing interfaces to use a SOAP communication channel rather than File. The file currently contains FIDCCP02 Idocs.
I have created a new communication channel using SOAP 7.1 and generated a Java client. When I send a request to the endpoint from Java, PI returns a SOAP fault.
Error
The error in the monitor is 'No standard agreement found for ..'. I think this is because the file contains XML with a root element with no namespace, but the root element in the SOAP message does have a namespace.
Example requests
File message :
<FIDCCP02 xmlns:ns2="http://dorsetcc.gov.uk/FIN_I26/Invoice/PremierFin" xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
SOAP message :
<ns2:FIDCCP02 xmlns:ns2="http://dorsetcc.gov.uk/FIN_I26/Invoice/PremierFin" xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
When I send a test request from RWB with no namespace it is successful.
Attempt to remove namespace
I have tried adding AF_Modules/XMLAnonymizerBean with no parameters as the first module on the SOAP communication channel, but this does not appear to make any difference. I have refreshed the cache.
regards
Steve

Hello Iñaki
Thanks for your reply.
I had read the blog about the XMLAnonymizerBean. It looks very straightforward, and in theory should do just what I need.
I've added the anonymizer bean as the first module as the SOAP message is asynchronous, and I want to remove the namespaces from the request.
I want to exclude all namespaces so I haven't set any parameters.
The SOAP channel in Communication Channel monitor has a status of 'Channel Started but inactive'. I cannot see any messages in the Processing Details for this channel, even though I have sent test messages from Java code and from RWB (the message from RWB without the namespace does reach the receiver). This makes me wonder if I have not configured the interface to use the new SOAP channel correctly, although I can see it in the Receiver Determination configuration overview.
I can see the messages in SXMB_MONI but can't find which communication channel is being used by the sender.
I'm using PI 7.1.
regards
Steve

How to capture SOAP fault when using "Do not use SOAP envelope" parameter

Hi,
we have a synchronous RFC -> XI -> Web Service scenario. The Web Service requires some custom SOAP header elements for user authorization which forced us create the entire SOAP message in a message mapping and to set the "Do not use SOAP envelope" parameter in the receiving SOAP adapter.
In order to capture the SOAP fault message from the Web Service we have created a message interface with a fault message and also created an interface mapping with a fault message mapping.
Our problem is that the fault message is not populated when we get a SOAP fault message back from the Web Service. Is this due to the fact that we have set the "Do not use SOAP envelope" parameter?
Thanks in advance!
Stefan
Message was edited by:
Stefan Nilsson

Hi Bhavesh,
I have exaactly same scenario. But the only difference is that the Successful payload is also not coming into PI.
The request is successfully hittng the webservice.
Please guide me on how to capture the paylod.
I am using the WSDL provided by the thirdparty but sill the message is not coming into PI.

Need current date embedded in scheduled request parameter

Hi Experts,
Need current date embedded in scheduled request parameter
I have a concurrent program
This is scheduled to run every day.
One of the requests has a parameter that I need to set with the current date (YYYYMMDD), I tried fnd_standard_date, date value sets in the parameter..
I tried using a SQL Statement (select to_char(sysdate, 'YYYYMMDD') from dual), but it appears to only run this when the request if first submitted and not on subsequent resubmissions. So the date never changes.
The box is checked to "Increment date parameters each run" but since this is a date value in a regular parameter, it is not getting incremented.
Any ideas how I can get this value to change every day?
Please help it's very urgent.
With Regards,
Kumar.

Hi,
Please see if the following documents help.
Note: 861953.1 - Request Set Date Parameters Are Not Defaulted As Per Setup
Note: 339849.1 - Unexpected Behavior Using Increment Date Parameter Each Run
Regards,
Hussein

Syntax to pass parameter value to jsp using href in out.println

Hi,
I have the URL in the form as mentioned below:
<a href="b2c/marketing/showDocDetail.jsp"> <%=doc_no%></a>
I've created the hyperlink using href tag to the document number in the jsp using the below syntax.
<% String a1 = "Document ";
       String a2 = "<a href=\"";
       String a3 = "marketing/showDocDetail.jsp\">";
       String a4 = doc_no;
       String a5 = "</a>";
out.println(a1a2a3a4a5);
%>
When clicked the doc_no is passed to backend RFC and export parameter is retrieved to result.jsp where values along with doc_no are displayed.
the value after clicked is not being passed to action.java class that does the retreival.
Needful, backend class, bom, entry in config.xml is all maintained.
Please help me out with the syntax to pass the parameter value into java class

Hi Bharathi,
try below.
<%
       String a1 = "Document ";
       String a2 = "<a href=\"";
       String a3 = "marketing/showDocDetail.do?docNo=";
       String a4 = doc_no;
       String a5 = " \">";
       String a6 = doc_no;
       String a7 = "</a>";
out.println(a1+a2+a3+a4+a5+a6+a7);
%>
I assume doc_no is java variable contains value of document number
Now create action entry in config.xml file. Suppose "actionDoc.java" class process it.
<action path="/marketing/showDocDetail" type="com.xyz.actions.actionDoc">
               <forward name="success" path="/marketing/showDocDetail.jsp"/>
               <forward name="error" path="/marketing/showDocDetail.jsp"/>
</action>
We are passing parameter docNo=doc_no to action class actionDoc.java in this class you can retrieve request parameter docNo from request object and then process it as you want.
Let me know if you face any problem or error.
eCommerce Developer
Edited by: Ecommerce Developer on Nov 9, 2009 8:35 AM

Pass Parameter to second.jsp using "form & action"

I wrote a JSP Portlet. Like the sample, multipage. But, I need to use <form> to pass the parameter to second.jsp
The first.jsp include:
<form name="parameters" method="POST" action="<%= HttpPortletRendererUtil.htmlFormActionLink(request,PortletRendererUtil.PAGE_LINK) + "?" + HttpPortletRendererUtil.portletParameter(request, "next_page") + "=second.jsp" %>" >
The provider.xml include:
<pageParameterName>next_page</pageParameterName>
But, error occur and show as following:
Wed, 21 Mar 2001 10:20:02 GMT
No DAD configuration Found
DAD name:
PROCEDURE : !null.wwpob_page.show
URL : http://oraas2:80/pls/null/!null.wwpob_page.show?_pageid=null
PARAMETERS :
===========
ENVIRONMENT:
============
Do I have to do something with next_page or pageID?
I have run the first.jsp in the sample that JPDK provided. After each click, the screen will refresh.
null

Leo,
The error you are getting is actually a portal error, you have an incorrect URL.
http://oraas2:80/pls/null/!null.wwpob_page.show?_pageid=null
If you notice, after pls, you should have a DAD name such as portal30. Instead you have null. Take a look at your Database access descriptors in Portal and update your URL.
Sue

Pass request parameter to portlet in jsp

Hi,
I wrote a simple PDK portlet that passes a request parameter to itself. Integrated in a portal page, the parameter passing works as intended.
Integrated in a jsp using the Oracle taglib, the parameter passing does not work. Here is the code I am using:
<portal:usePortal />
<html>
<head>
<title>Test-JSP</title>
</head>
<portal:showPortlet name="myPortlet" header="false"/>
</body>
</html>
(index.jsp)
<?xml version = '1.0' encoding = 'UTF-8'?>
<?providerDefinition version="3.1"?>
<provider class="oracle.portal.provider.v2.DefaultProviderDefinition">
<session>false</session>
<passAllUrlParams>false</passAllUrlParams>
<preferenceStore class="oracle.portal.provider.v2.preference.FilePreferenceStore">
<name>prefStore1</name>
<useHashing>true</useHashing>
</preferenceStore>
<portlet class="oracle.portal.provider.v2.DefaultPortletDefinition">
<id>1</id>
<name>MyPortlet</name>
<title>My Portlet</title>
<description>My Portlet</description>
<timeout>40</timeout>
<showEditToPublic>false</showEditToPublic>
<hasAbout>false</hasAbout>
<showEdit>false</showEdit>
<hasHelp>false</hasHelp>
<showEditDefault>true</showEditDefault>
<showDetails>false</showDetails>
<renderer class="oracle.portal.provider.v2.render.RenderManager">
<renderContainer>true</renderContainer>
<renderCustomize>true</renderCustomize>
<autoRedirect>true</autoRedirect>
<contentType>text/html</contentType>
<showPage>/jsp/show.jsp</showPage>
<editDefaultsPage>/jsp/editdefaults.jsp</editDefaultsPage>
</renderer>
<personalizationManager class="oracle.portal.provider.v2.personalize.PrefStorePersonalizationManager">
<dataClass>oracle.portal.provider.v2.personalize.NameValuePersonalizationObject</dataClass>
</personalizationManager>
</portlet>
</provider>
(provider.xml)
What did I do wrong?
Regards
Thomas

I forgot to mention that the jsp is external and that I am using Portal 10.1.2.
With internal jsps the parameter passing works fine.
Amazingly portletRenderRequest.getRenderContext().getPageURL() contains the request parameter. It would be possible to extract it from the url. But I really don't want to do that.

Request parameter of Web Service Data Control shows up as an Object

I have deployed a simple web service on a peoplesoft instance.
The request message is:
<?xml version="1.0" encoding="windows-1252" ?>
<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
xmlns="http://www.example.org"
targetNamespace="http://www.example.org"
elementFormDefault="qualified">
<xsd:element name="SSR_CLASS_SEARCH_REQ">
<xsd:annotation>
<xsd:documentation>
A sample element
</xsd:documentation>
</xsd:annotation>
<xsd:complexType>
<xsd:sequence>
<xsd:element name="INSTITUTION" type="xsd:string" nillable="true"/>
<xsd:element name="TERM" type="xsd:string" nillable="true"/>
<xsd:element name="CAREER" type="xsd:string" nillable="true"/>
<xsd:element name="SUBJECT" type="xsd:string" nillable="true"/>
<xsd:element name="CLASS_NBR" type="xsd:int" nillable="true"/>
</xsd:sequence>
</xsd:complexType>
</xsd:element>
</xsd:schema>
While the response message has a depth of three levels:
In jdev 11g (Studio Edition Version 11.1.1.1.0, Build JDEVADF_11.1.1.1.0_GENERIC_090615.0017.5407) the one available for download on OTN, I perform the following steps.
Create a Web Service Data control using the WSDL url, generated from the PSFT end.
The Data control creates successfully. The problem is:
- In the service operation method (in the data control) the request parameter is shown as an Object.
- The entry under the service operation parameter tree, is 'paramater'
The data control looks like:
- <datacontrolname>
- <serviceOperationName>_parameters
- parameter
- CAREER
- CLASS_NBR
- INSTITUTION
- SUBJECT
- TERM
- <serviceOperationName>(Object)
- Parameters
- parameter
- Return
- <Return type>
The return type shows up fine, with collections in hierarchy of a depth of tree.
How do I create a parameter form for this data control.

Hi,
In this usecase , you can DnD the <serviceOperationName>_parameters as an ADF from. Then DnD the operation as a method. The methods input arg value is automatically set to the parameterIterator.currentRow.DataProvider. This works fine.

UIX-JSP: Error in request parameter

Hi:
In my page browse, wheni press the button "Create" and select the new row and late press the button "update" i got and error:
Row was not found using request parameter: 00010000000000000006000000EF42F52F97
The complete error is following:
Exception Details
oracle.jbo.JboException: Row was not found using request parameter: 00010000000000000006000000EF42F52F97.
     void oracle.jbo.JboException.(java.lang.String)
     void oracle.jbo.html.jsp.datatags.RowTag.handleAction()
     int oracle.jbo.html.jsp.datatags.RowTag.doStartTag()
     void RhConceptoView_Edit._jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
     void oracle.jsp.runtime.HttpJsp.service(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
     void oracle.jsp.runtimev2.JspPageTable.service(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String)
     void oracle.jsp.runtimev2.JspServlet.internalService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
     void oracle.jsp.runtimev2.JspServlet.service(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
     void javax.servlet.http.HttpServlet.service(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
     void com.evermind.server.http.ServletRequestDispatcher.invoke(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
     void com.evermind.server.http.ServletRequestDispatcher.forwardInternal(javax.servlet.ServletRequest, javax.servlet.http.HttpServletResponse)
     void com.evermind.server.http.ServletRequestDispatcher.forward(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
     void com.evermind.server.http.GetParametersRequestDispatcher.forward(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
     void com.evermind.server.http.EvermindPageContext.forward(java.lang.String)
     void RhConceptoView_Browse._jspService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
     void oracle.jsp.runtime.HttpJsp.service(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
     void oracle.jsp.runtimev2.JspPageTable.service(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse, java.lang.String)
     void oracle.jsp.runtimev2.JspServlet.internalService(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
     void oracle.jsp.runtimev2.JspServlet.service(javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)
     void javax.servlet.http.HttpServlet.service(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
     void com.evermind.server.http.ServletRequestDispatcher.invoke(javax.servlet.ServletRequest, javax.servlet.ServletResponse)
     void com.evermind.server.http.ServletRequestDispatcher.forwardInternal(javax.servlet.ServletRequest, javax.servlet.http.HttpServletResponse)
     boolean com.evermind.server.http.HttpRequestHandler.processRequest(com.evermind.server.ApplicationServerThread, com.evermind.server.http.EvermindHttpServletRequest, com.evermind.server.http.EvermindHttpServletResponse, java.io.InputStream, java.io.OutputStream, boolean)
     void com.evermind.server.http.HttpRequestHandler.run(java.lang.Thread)
     void com.evermind.util.ThreadPoolThread.run()

I'm not an expert in UIX-JSP, can anybody help me, PLEASE?.

Remove danger of using a request parameter in a JSP:include

Similar Messages

Maybe you are looking for