XSS Auditor

Hello,
When connecting with Safari to the administrative web interface of a network device, the console often shows messages like this one:
The XSS Auditor refused to execute a script in 'someurl' because its source code was found within the request. The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header.
Of course, a lot of functionalities are therefore unavailble through the web interface...
And since I don't have any control upon the pages served by the device, I'm stuck.
Is there a way to (temporarily) turn off the XSS Auditor in Safari?
It looks like there is a xssAuditorEnabled setting in Webcore, but I didn't manage to go very far with that "knowledge"...
TIA,
Axel

So, for those who might be facing the same problem...
Very empirically, I managed to find that way for Safari 6.1.5:
defaults write com.apple.Safari "com.apple.Safari.ContentPageGroupIdentifier.WebKit2XSSAuditorEnabled" -bool FALSE
Of course, better to set above value to TRUE once the XSS Auditor deactivation isn't needed anymore. ;-)
HTH,
Axel

Similar Messages

XSS vulnerability in 2.0.63

This came from our PCI auditor:
problem: Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier.
Fix: Wait for Apache version 2.0.64 (or upgrade to the head of the 2.0.x branch) As of August 2008, Apache 2.0.64 has not been released yet. Users wishing to benefit from the security fixes it will contain may
upgrade to the head of the SVN 2.0.x branch.
I believe I am at the lastest 2.0.63 but it mentioned something about revision 682871.... how can i find this information to see where I am at. Also, does anyone have any inside info on when 2.0.64 will be released.

Unfortunately, we have to pass our PCI audit. I think I know the solution. Yank the power cord.
Funny thing, there is much debate going on whether this is truly a vulnerability or not.
I guess I will ride it out and wait for 2.0.64.
thanks for the responses.
Originally Posted by AndersG
StacieWhite,
> Apache site says 2.063 is legacy while 2.2 is the best version to have.
> Is this compatible with netware 6.5 and webaccess 7.02? Thanks
>
No. You can run it as a separate instance though. What is the "best"
version of Apache is debatable ;) I suggest you stick to 2.0 for now.
- Anders Gustafsson (Sysop)
The Aaland Islands (N60 E20)
Discover the new Novell forums at http://forums.novell.com
Novell does not monitor these forums officially.
Enhancement requests for all Novell products may be made at
Enhancement Request

XSS on NetWeaver Java Stack - Trial version

A couple of "newbie" questions:
a) Is it possible to install/configure the Business Packages for XSS (ESS/MSS) to the <b>Trial version</b> of NetWeaver 04s - Enterprise Portal ?
b) Would anyone have a "current" write up on how to do this? (There seems to be plenty of previous version write-up - but not too much for current or trial version)
Thanks,
Rick

>
Olivier CHRETIEN wrote:
> I am aware that SAP partners sell Login modules which are able to use RC4 for SPnego Kerberos authentication but the price that they ask for it is so high that it is not a possibility. (more expensive that the cost of the project which needs it...)
> Regards,
> Olivier
I am not sure which products you have looked at cost for, but I don't beleive you have checked this product out: http://ecohub.sdn.sap.com/irj/ecohub/solutions/trustbrokeradapter
- you will find it to be very cost effective since it is not priced on per user basis - it is a fixed cost per installation, so you would just need to pay a few thousand dollars to get what you need for unlimited number of users. Also, discounts are available if you ask :-).
Thanks,
Tim

AP Line-Item Report for State Auditors

Dear Members,
I am preparing one Report named AP Line-Item Report for State Auditors and i need the following fields in my report.
Check Number                PAYR-CHECT
Voucher Number             BSEG-BELNR
Check Date                     PAYR-ZALDT
Voucher Date                     BKPF-BUDAT
Vendor Number             LFA1-LIFNR
Vendor Name                     ADRC-NAME1
Vendor Street Address     ADRC-STREET
Vendor City                     ADRC-CITY1
Vendor State                     ADRC-REGIO
Vendor Zip Code             ADRC-POST_CODE1
General Ledger Acct No     BSEG-HKONT
Purchase Order Number     BSEG-EBELN
Tax Status Code             BSEG-MWSKZ
Taxable Amount             BSEG-HWBAS
Exempt Amount             BSEG-MWSTS
Tax                                     BSEG-MWSTS
Tax Accrued                     BSEG-MWSTS
Total Invoice                      BSEG-DMBTR
I am new to FI.So I request some one please let me know which datasources contain the above fields and which CUBE is best suited for this.
Thanks in Advance for help and quick reply is much much appreciated.
Best Regards
RC

0VENDOR_ATTR - Vendor Master Data Attributes
0FI_AP_51 - Check Register Line Items
0FI_AP_4 - Accounts Payable Line Items
It should be noted, however, that this won't get you everything that you need, so you may have to create enhance one or more of these DataSources and create User Exit ABAP code to get the required data. Also, the 0FI_AP_51 DataSource isn't available if your source system isn't ECC6 EHP3 or higher. If your source system is less than that, you're going to have to create a generic DataSource for the data from the PAYR table.

Cutom.xss Not working in R12

Hi ,
I have done some color change on a table column based on certain condition. which is working fine in 11i instance but when i have migrated the same in R12 it is not working.
Code in (PR) :
OALinkBean bean1 = (OALinkBean)webBean.findChildRecursive("Addi1");
if (thsholdVal<CalThVAl)
{ row.setcolor("1");
OADataBoundValueViewObject cssjob1 = new OADataBoundValueViewObject(bean1,"color");
bean1.setAttributeValue(oracle.cabo.ui.UIConstants.STYLE_CLASS_ATTR, cssjob1);
else
row.setcolor("2");
OADataBoundValueViewObject cssjob1 = new OADataBoundValueViewObject(bean1,"color");
bean1.setAttributeValue(oracle.cabo.ui.UIConstants.STYLE_CLASS_ATTR, cssjob1);
Custom.xss code: (Location $OA_HTML/cabo/styles)
<style selector=".2">
<includeStyle name="DefaultFontFamily"/>
<property name="background-color">#00FF00</property>
</style>
<style selector=".1">
<includeStyle name="DefaultFontFamily"/>
<property name="background-color">#FF0000</property>
</style>
Please give me a response if i missed any thing or i need to make some R12 specific change.

I don't think there is a specific change required for R12. Have you bounced the Apache after replacing the custom.xss file?
Thanks
Shree

Type com.sap.xss.ser.xssmenu.model.types.P_Pernr does not exist

Hi there,
same Thread I post in "Portal Developement". Now I try my luck in ths category...
we implement ESS (ERP2004 with WebDynpros) in our testsystem, but we got an error and don´t know what to do...
System Landscape:
- mySAP Enterprise Portal 6.0 SP17
- Java Application Server (excluding from HR)
- mySAP ERP2004 HR-System
The Connections from the portal runs to the Java-App-Server, not direct to the HR-System (HR-System has no Java Installation and our Customer don´t want a installation, because it could be a bad performance)
We implement the Jco´s and fill out the usermapping. If we want to call the firstpage of the new ESS-Role we get this error.
Can anyone help us? Do we need some installations?
Best regards
Christian
Error
500 Internal Server Error
Web Dynpro Container/SAP J2EE Engine/6.40
Failed to process request. Please contact your system administrator.
Error Summary
While processing the current request, an exception occured which could not be handled by the application or the framework.
If the information contained on this page doesn't help you to find and correct the cause of the problem, please contact your system administrator. To facilitate analysis of the problem, keep a copy of this error page. Hint: Most browsers allow to select all content, copy it and then paste it into an empty document (e.g. email or simple text file).
Root Cause
The initial exception that caused the request to fail, was:
com.sap.dictionary.runtime.DdException: Type com.sap.xss.ser.xssmenu.model.types.P_Pernr does not exist
at com.sap.dictionary.types.mdi.util.ProviderUtil.createAbapTypeXmlMap(ProviderUtil.java:400)
at com.sap.dictionary.runtime.mdi.DataProvider.createSimpleTypeFromAbapType(DataProvider.java:586)
at com.sap.dictionary.runtime.mdi.DataProvider.getDataType(DataProvider.java:286)
at com.sap.dictionary.runtime.DdDictionary.getDataType(DdDictionary.java:95)
at com.sap.dictionary.runtime.DdBroker.getDataType(DdBroker.java:164)
... 54 more
See full exception chain for details.
System Environment
Client
Web Dynpro Client Type HTML Client
User agent Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; InfoPath.1; .NET CLR 2.0.50727)
Version
DOM version
Client Type msie6
Client Type Profile ie6
ActiveX enabled
Cookies enabled
Frames enabled
Java Applets enabled
JavaScript enabled
Tables enabled
VB Script enabled
Server
Web Dynpro Runtime Vendor: SAP, Build ID: 6.4015.00.0000.20051123162612.0000 (release=630_VAL_REL, buildtime=2005-12-14:21:51:22[UTC], changelist=377533, host=PWDFM026)
J2EE Engine No information available
Java VM Classic VM, version:1.4.2, vendor: IBM Corporation
Operating system AIX, version: 5.2, architecture: ppc64
Other
Session Locale de
Time of Failure Thu Jan 11 16:14:11 GMT+00:00 2007 (Java Time: 1168532051021)
Web Dynpro Code Generation Infos
sap.com/pcui_gp~xssutils
SapDictionaryGenerationCore 6.4018.00.0000.20060530191647.0000 (release=630_REL, buildtime=2006-09-20:21:03:45[UTC], changelist=405154, host=PWDFM027.wdf.sap.corp)
SapDictionaryGenerationTemplates 6.4018.00.0000.20060530191647.0000 (release=630_REL, buildtime=2006-09-20:21:03:57[UTC], changelist=405154, host=PWDFM027.wdf.sap.corp)
SapGenerationFrameworkCore 6.4015.00.0000.20050818152155.0000 (release=630_VAL_REL, buildtime=2005-11-24:21:18:08[UTC], changelist=363812, host=PWDFM026.wdf.sap.corp)
SapIdeWebDynproCheckLayer 6.4018.00.0000.20060823112633.0000 (release=630_REL, buildtime=2006-09-20:21:14:40[UTC], changelist=415262, host=PWDFM027.wdf.sap.corp)
SapMetamodelCommon 6.4018.00.0000.20060302125746.0000 (release=630_REL, buildtime=2006-09-20:20:56:46[UTC], changelist=392271, host=PWDFM027.wdf.sap.corp)
SapMetamodelCore 6.4018.00.0000.20060302125746.0000 (release=630_REL, buildtime=2006-09-20:20:56:36[UTC], changelist=392271, host=PWDFM027.wdf.sap.corp)
SapMetamodelDictionary 6.4018.00.0000.20060302125547.0000 (release=630_REL, buildtime=2006-09-20:21:00:39[UTC], changelist=392265, host=PWDFM027.wdf.sap.corp)
SapMetamodelWebDynpro 6.4018.00.0000.20060823112248.0000 (release=630_REL, buildtime=2006-09-20:21:09:40[UTC], changelist=415252, host=PWDFM027.wdf.sap.corp)
SapWebDynproGenerationCTemplates 6.4018.00.0000.20060915154217.0000 (release=630_REL, buildtime=2006-09-20:21:52:30[UTC], changelist=417774, host=PWDFM027)
SapWebDynproGenerationCore 6.4018.00.0000.20060823112633.0000 (release=630_REL, buildtime=2006-09-20:21:15:10[UTC], changelist=415262, host=PWDFM027.wdf.sap.corp)
SapWebDynproGenerationTemplates 6.4018.00.0000.20060915154217.0000 (release=630_REL, buildtime=2006-09-20:21:52:30[UTC], changelist=417774, host=PWDFM027)
sap.com/tcwddispwda
No information available
sap.com/pcui_gp~xssfpm
SapDictionaryGenerationCore 6.4018.00.0000.20060530191647.0000 (release=630_REL, buildtime=2006-09-20:21:03:45[UTC], changelist=405154, host=PWDFM027.wdf.sap.corp)
SapDictionaryGenerationTemplates 6.4018.00.0000.20060530191647.0000 (release=630_REL, buildtime=2006-09-20:21:03:57[UTC], changelist=405154, host=PWDFM027.wdf.sap.corp)
SapGenerationFrameworkCore 6.4015.00.0000.20050818152155.0000 (release=630_VAL_REL, buildtime=2005-11-24:21:18:08[UTC], changelist=363812, host=PWDFM026.wdf.sap.corp)
SapIdeWebDynproCheckLayer 6.4018.00.0000.20060823112633.0000 (release=630_REL, buildtime=2006-09-20:21:14:40[UTC], changelist=415262, host=PWDFM027.wdf.sap.corp)
SapMetamodelCommon 6.4018.00.0000.20060302125746.0000 (release=630_REL, buildtime=2006-09-20:20:56:46[UTC], changelist=392271, host=PWDFM027.wdf.sap.corp)
SapMetamodelCore 6.4018.00.0000.20060302125746.0000 (release=630_REL, buildtime=2006-09-20:20:56:36[UTC], changelist=392271, host=PWDFM027.wdf.sap.corp)
SapMetamodelDictionary 6.4018.00.0000.20060302125547.0000 (release=630_REL, buildtime=2006-09-20:21:00:39[UTC], changelist=392265, host=PWDFM027.wdf.sap.corp)
SapMetamodelWebDynpro 6.4018.00.0000.20060823112248.0000 (release=630_REL, buildtime=2006-09-20:21:09:40[UTC], changelist=415252, host=PWDFM027.wdf.sap.corp)
SapWebDynproGenerationCTemplates 6.4018.00.0000.20060915154217.0000 (release=630_REL, buildtime=2006-09-20:21:52:30[UTC], changelist=417774, host=PWDFM027)
SapWebDynproGenerationCore 6.4018.00.0000.20060823112633.0000 (release=630_REL, buildtime=2006-09-20:21:15:10[UTC], changelist=415262, host=PWDFM027.wdf.sap.corp)
SapWebDynproGenerationTemplates 6.4018.00.0000.20060915154217.0000 (release=630_REL, buildtime=2006-09-20:21:52:30[UTC], changelist=417774, host=PWDFM027)
sap.com/tcwdcorecomp
No information available
Detailed Error Information
Detailed Exception Chain
com.sap.tc.webdynpro.services.exceptions.WDTypeNotFoundException: type com.sap.xss.ser.xssmenu.model.types.P_Pernr could not be loaded: com.sap.dictionary.runtime.DdException: Type com.sap.xss.ser.xssmenu.model.types.P_Pernr does not exist
at com.sap.tc.webdynpro.services.datatypes.core.DataTypeBroker.getSimpleType(DataTypeBroker.java:250)
at com.sap.tc.webdynpro.services.datatypes.core.DataTypeBroker.getDataType(DataTypeBroker.java:213)
at com.sap.tc.webdynpro.progmodel.context.DataAttributeInfo.init(DataAttributeInfo.java:314)
at com.sap.tc.webdynpro.progmodel.context.NodeInfo.initAttributes(NodeInfo.java:669)
at com.sap.tc.webdynpro.progmodel.context.DataNodeInfo.doInit(DataNodeInfo.java:233)
at com.sap.tc.webdynpro.progmodel.context.NodeInfo.init(NodeInfo.java:654)
at com.sap.tc.webdynpro.progmodel.context.NodeInfo.init(NodeInfo.java:657)
at com.sap.tc.webdynpro.progmodel.context.Context.init(Context.java:40)
at com.sap.tc.webdynpro.progmodel.controller.Controller.init(Controller.java:199)
at com.sap.tc.webdynpro.clientserver.cal.ClientComponent.init(ClientComponent.java:347)
at com.sap.tc.webdynpro.clientserver.cal.ClientComponent.createComponent(ClientComponent.java:855)
at com.sap.tc.webdynpro.clientserver.cal.ClientComponent.createComponent(ClientComponent.java:158)
at com.sap.tc.webdynpro.progmodel.components.ComponentUsage.createComponentInternal(ComponentUsage.java:143)
at com.sap.tc.webdynpro.progmodel.components.ComponentUsage.createComponent(ComponentUsage.java:135)
at com.sap.pcuigp.xssfpm.wd.FPMComponent$ComponentUsageManager.createBLCComponentUsage(FPMComponent.java:628)
at com.sap.pcuigp.xssfpm.wd.FPMComponent$FPM.attachComponentToUsage(FPMComponent.java:773)
at com.sap.xss.ser.xssmenu.vc.header.VcXssMenuHeader.onInit(VcXssMenuHeader.java:196)
at com.sap.xss.ser.xssmenu.vc.header.wdp.InternalVcXssMenuHeader.onInit(InternalVcXssMenuHeader.java:225)
at com.sap.xss.ser.xssmenu.vc.header.VcXssMenuHeaderInterface.onInit(VcXssMenuHeaderInterface.java:162)
at com.sap.xss.ser.xssmenu.vc.header.wdp.InternalVcXssMenuHeaderInterface.onInit(InternalVcXssMenuHeaderInterface.java:144)
at com.sap.xss.ser.xssmenu.vc.header.wdp.InternalVcXssMenuHeaderInterface$External.onInit(InternalVcXssMenuHeaderInterface.java:220)
at com.sap.pcuigp.xssfpm.wd.FPMComponent.doProcessEvent(FPMComponent.java:466)
at com.sap.pcuigp.xssfpm.wd.FPMComponent.doEventLoop(FPMComponent.java:354)
at com.sap.pcuigp.xssfpm.wd.FPMComponent.wdDoInit(FPMComponent.java:179)
at com.sap.pcuigp.xssfpm.wd.wdp.InternalFPMComponent.wdDoInit(InternalFPMComponent.java:110)
at com.sap.tc.webdynpro.progmodel.generation.DelegatingComponent.doInit(DelegatingComponent.java:95)
at com.sap.tc.webdynpro.progmodel.controller.Controller.initController(Controller.java:215)
at com.sap.tc.webdynpro.progmodel.controller.Controller.init(Controller.java:200)
at com.sap.tc.webdynpro.clientserver.cal.ClientComponent.init(ClientComponent.java:347)
at com.sap.tc.webdynpro.clientserver.cal.ClientApplication.init(ClientApplication.java:370)
at com.sap.tc.webdynpro.clientserver.task.WebDynproMainTask.execute(WebDynproMainTask.java:608)
at com.sap.tc.webdynpro.clientserver.cal.AbstractClient.executeTasks(AbstractClient.java:59)
at com.sap.tc.webdynpro.clientserver.cal.ClientManager.doProcessing(ClientManager.java:248)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doWebDynproProcessing(DispatcherServlet.java:154)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doContent(DispatcherServlet.java:116)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doPost(DispatcherServlet.java:55)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:390)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:264)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:347)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:325)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:887)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:241)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:92)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:148)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java(Compiled Code))
at java.security.AccessController.doPrivileged1(Native Method)
at java.security.AccessController.doPrivileged(AccessController.java(Compiled Code))
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java(Compiled Code))
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java(Compiled Code))
Caused by: com.sap.dictionary.runtime.DdException: Type com.sap.xss.ser.xssmenu.model.types.P_Pernr does not exist
at com.sap.dictionary.types.mdi.util.ProviderUtil.createAbapTypeXmlMap(ProviderUtil.java:400)
at com.sap.dictionary.runtime.mdi.DataProvider.createSimpleTypeFromAbapType(DataProvider.java:586)
at com.sap.dictionary.runtime.mdi.DataProvider.getDataType(DataProvider.java:286)
at com.sap.dictionary.runtime.DdDictionary.getDataType(DdDictionary.java:95)
at com.sap.dictionary.runtime.DdBroker.getDataType(DdBroker.java:164)
at com.sap.dictionary.runtime.DdBroker.getSimpleType(DdBroker.java:170)
at com.sap.tc.webdynpro.services.datatypes.core.DataTypeBroker.getSimpleType(DataTypeBroker.java:242)
... 52 more

Hi,
uhm... good question, long time ago...
Error should be in the JCO-Destinations, where you can choose a targetsystem for each Jco-Destination.
Since them we installed a java on the abap-system, so we have a doublestack.
In the Jco Destiantions must be the ABAP-System.
Application via SAPTicket and MetaData via fix User like DDIC.
Regards
Christian

Customer Report for Auditors

Hi,
I would like to know if there is any report in which appears customer items but showing debit and credit and relating each invoice with its payment (if the invoice is paid). FBL5N transaction for example does not relate an invoice with its payment clearly. We need it to show such information to auditors.
Thank you very much,
Ariana
Message was edited by:
Ariana Landaluce

Hi,
When I try to use FBL5N and I sort by clearing document my problem is when I have special GL transactions (I use bill of exchange presentation). When I have a customer invoice, then I run F110, then FBWE and finally F-20 I have two different clearing documents... So it is difficult to show all this proccess in FBL5N to auditors.
Do you know a better way to obtain this information? With SECR I have not been able to obtain it.
Thanks,
Ariana

I need information about how to build a XSS file, please.

Hi,
I want to create a XSS file for defining the styles of my application, but I have not been able to find information about the properties names and properties possible values of the style elements of the XSS file.
For example, where is said that the statement <property name="border-width">2px 2px 0px 0px</property> defines the border line width?
If anybody knows where can I find a description of the XSS files, the properties, etc, please help me.
Thanks,
David.

Saleh,
I would recommend you take a look at LVSpeak built by one of my fellow NI employees and demo'd in a keynote and NI Week. Even has a tutorial on how to use it.
Sincerely,
Jason Daming
Applications Engineer
National Instruments
http://www.ni.com/support

How to define the application parameter 'sap.xss.BaseConfigurationID'

Hello All,
I am developing a webdynpro ESS custom self service application. I have completed the development of the DC. But at the end when I am creating the application for the DC, I am not able to figure it out how to define the application parameter 'sap.xss.BaseConfigurationID' for the application. I have defined remaining all the parameters as specified in the following link.
[http://help.sap.com/erp2005_ehp_03/helpdata/EN/43/3b95dab4ab1800e10000000a1553f6/content.htm]
Could any one please detail the process to define the parameter 'sap.xss.BaseConfigurationID' ?
Thanks a lot.
Regards,
Seshu.

Pick a representative file.
Get info. (Command-i)
There you will see a place "Open with" where you can select the application for that file.
Hit the "Change all..." button to do this for all files of this type.
charlie

Exit plug url parameters without XSS encoding

Hi,
I fire an exit plug with POST_PARAMETERS = 'X' and passing a different postParameters='sap-client=101&sap-user=5E224C57E11&sap-password=Asdf1234'. However the special characters are encoded and not passed correctly to the webdynpro app.
I got this behavior from CREATE_EXTERNAL_WINDOW with USE_POST = abap_true settings. I am trying to hide the sap-user and sap-password from the URL when redirecting to a new WebDynpro app in the same way, but remain in the current window.
My question is how can I prevent the automatic XSS encoding? I have turned off the login XSRF flag in SICF, but it has no effect on this.
Another option if somebody can tell me how can I do the same as CREATE_EXTERNAL_WINDOW in the same window, it should also be fine.
Your help is appreciated.
Charlie

>
Frederic Wood wrote:
> Thank you Frank! This accomplished exactly what I asked. Points awarded!
>
> However...
>
> What is bugging me now is the fact that the BSP app is processed on the lo_client->send( ) and my POSTed parameters are visible, but the BSP is not displayed. Then, when I actually Fire my WD outbound plug to display the BSP, the BSP is processed and displayed, but the POSTed parameters have been lost...
>
> Your thoughts?
That is because there are two very different calls to the BSP application occuring. The solution that you said worked is using the HTTP Client (browser if you will) of the application server. Therefore it is the ABAP system itself that is calling the BSP application. That is why nothing is displayed on the client side - because the server itself is making the request and receiving the response. This approach is really only usable if you need to call a data service (REST based or something like that), not if you actually need to dispaly the response to the user.
When you fire the navigation plug, it is the browser on the client machine that is making the request to the BSP application. This is completely separate from the request made from the application server in the previous step.
If you can't use GET and URL parameters, then you should just consider using Server Cookies. I don't think that hte HTTP Client class approach is going to get you what you want.

SQL Injections and XSS - Escaping Special Characters

Hi, hope someone can help in regards to security and SQL Injections and XSS.
We are using APEX 4.0.2 on Oracle 11.2.0.2.
1. It seems the special characters we have entered into normal 'Text Items' 'Text Areas' etc are not being escaped (ie <,>,&, '). If I enter them into the field (ie Surname) they are saved as is into session state and the database - no escaping. Am I missing something such as an environment setting as I thought the "smart" oracle escaping rules would cater for this.
Surely I don't have to manually do each of then.
Just to confirm, am I looking in the correct places to assess if the characters are escaped or not - ie should they show as '&<>' in session state and/or the database ?
2. Also, for the Oracle procedures such as '‘wwv_flow.accept’ , ‘wwv_flow.show’ , 'wwv_flow_utilities.show_as_popup_calendar' - do these escape special characters. If not, then they must be vulnerable to SQL Injections attacks.
Thx
Nigel

Recx Ltd wrote:
Just to pitch in, escaping values internally (either in the database or session state) is extremely problematic. Data searches, string comparison, reporting and double escaping are all areas which suffer badly when you do this.
Stripping characters on input can also cause problems if not considered within the context of the application. Names such as "O'Niel", statistical output such as "n < 300", fields containing deliberate HTML markup can be annoying to debug. In certain situations stripping is totally ineffective and may still lead to cross-site scripting.
Apex applications that share the database with other applications will also be affected.
The database should contain 'raw' unfettered data and output should be escaped properly, as Joel said, at render time. Either with Apex attributes or using PLSQL functions such as htf.escape_sc() as and when required.Do not needlessly resurrect old threads. After a couple of months watches expire and the original posters are not alerted to the presence of your follow-up.
Shameless plug: If you are in the game of needing to produce secure Apex code, you should get in touch.This crosses the line into spam: it violates the OTN Terms of Use—see 6(j).
Promotional posts like this are liable to be removed by the moderators.

XSS SCA import in CMS error: failed to build

We are getting error when trying to build XSS Track in NWDI. There are 2 brocken DC for development track.
Here is the error message that we get:
Development Component Build (2008-11-28 22:04:10)
Component name: mss/mol
Component vendor: sap.com
SC compartment: sap.com_SAP_MSS_1
Configuration: <SID>_XSS_D
Location: <SID>_XSS_D
Source code location: http://server01:55100/dtr/ws/XSS/sap.com_SAP_MSS/dev/active/DCs/sap.com/mss/mol/_comp/
DC root folder: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/mss/mol/_comp/
DC type: Web Dynpro
Host: server01
DC Model check:
   All used DCs are available locally
   validating dependency to build plugin "sap.com/tc/bi/bp/webDynpro"
   validating dependency to public part "FloorplanManager" of DC "sap.com/pcui_gp/xssfpm"
   validating dependency to public part "default" of DC "sap.com/tc/wd/webdynpro"
   validating dependency to public part "default" of DC "sap.com/com.sap.exception"
   validating dependency to public part "default" of DC "sap.com/tc/ddic/ddicruntime"
   validating dependency to public part "default" of DC "sap.com/tc/col/api"
   validating dependency to public part "default" of DC "sap.com/tc/wdp/metamodel/content"
   validating dependency to public part "Isrlpd" of DC "sap.com/pcui_gp/isrlpd"
   validating dependency to public part "default" of DC "sap.com/com.sap.mw.jco"
   validating dependency to public part "default" of DC "sap.com/com.sap.aii.proxy.framework"
   validating dependency to public part "default" of DC "sap.com/tc/logging"
   validating dependency to public part "default" of DC "sap.com/com.sap.aii.util.misc"
   validating dependency to public part "FPMUtils" of DC "sap.com/pcui_gp/xssutils"
   validating dependency to public part "default" of DC "sap.com/tc/ddic/metamodel/content"
   validating dependency to public part "default" of DC "sap.com/tc/cmi"
   validating dependency to public part "FinUtils" of DC "sap.com/mss/finutils"
   DC model check OK
Start build plugin:
   using build plugin: sap.com/tc/bi/bp/webDynpro
   starting build plugin from : /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/tc/bi/bp/webDynpro/_comp/gen/default/public/webDynpro/
Build Plugin 'WebdynproPlugin', Version 7.00 SP 16 (645_VAL_REL, built on 2008-06-09 20:46:40 CEST, CL83275)
   development component: mss/mol (sap.com)
      software component: SAP_MSS (sap.com)
       support component: EP-PCT-MGR-CO
                location: <SID>_XSS_D
                    type: Web Dynpro
           build variant: default
         output location: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/mss/mol/_comp/gen/default
       generation folder: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/t/64CE6536D7BD962CDCB65DC8A7640047
       plugin start time: 2008-11-28 22:04:11 GMT-07:00 (MST)
                 Java VM: Java HotSpot(TM) Client VM, 1.4.2_12-b03 (Sun Microsystems Inc.)
General options:
convert *.xlf to *.properties: yes
include sources for debugging: yes
Warning: Source folder "META-INF" exists but is empty and will be ignored.
Warning: Source folder "src/configuration" exists but is empty and will be ignored.
Preparing data context..
No public part descriptor found for component "tc/wd/webdynpro" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "com.sap.exception" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "tc/ddic/ddicruntime" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "tc/col/api" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "tc/wdp/metamodel/content" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "com.sap.mw.jco" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "com.sap.aii.proxy.framework" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "tc/logging" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "com.sap.aii.util.misc" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "tc/ddic/metamodel/content" (vendor "sap.com"), public part "default", using legacy mode.
No public part descriptor found for component "tc/cmi" (vendor "sap.com"), public part "default", using legacy mode.
No 'default' JDK defined, will use running VM.
Data context preparation finished in 0.934 seconds
Creating Ant build file..
Creating output file: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/mss/mol/_comp/gen/default/logs/build.xml
Using macro file:     /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/tc/bi/bp/webDynpro/_comp/gen/default/public/webDynpro/macros/build.vm
Build file creation finished in 1 second
Starting Ant..
Using build file:     /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/mss/mol/_comp/gen/default/logs/build.xml
Using build target:   build
Using Ant version:    1.6.2
compile:
      [echo] Starting dictionary generator
     [ddgen]
     [ddgen] [Info]    Property deployment is true: Deployment information is provided!
     [ddgen] [Info]    Property sourcepath: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/mss/mol/_comp/src/packages
     [ddgen] [Info]    Property targetpath: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/t/64CE6536D7BD962CDCB65DC8A7640047/gen_ddic
     [ddgen] [Info]    Property archivename: sap.commssmol
     [ddgen] [Info]    Property vendor: sap.com
     [ddgen] [Info]    Property dcname: mss/mol
     [ddgen] [Info]    Property projectlanguage: de
     [ddgen] [Info]    Property language: Available languages are automatically determined!
     [ddgen] [Info]    Property addpaths ...
     [ddgen] [Info]    Generating datatypes/com/sap/mss/mol/monitor/model/types/MolModel.gdictionary
     [ddgen] [Info]    Generating datatypes/com/sap/pcuigp/xssutils/objectselection/model/types/FcObjectSelection.gdictionary
     [ddgen] [Info]    Generating datatypes/com/sap/pcuigp/xssutils/pernr/model/types/RHXSS_SER_EMPLOYEE.gdictionary
     [ddgen] [Info]    Generating dbtables/sdmDeployDd.xml
     [ddgen] [Info]    Generation finished (8 seconds)
     [ddgen]
     [timer] Dictionary generator finished in 8.499 seconds
      [echo] Starting WebDynpro generator
     [wdgen]
     [wdgen] [Info]    Property deployment is true: Deployment information is provided!
     [wdgen] [Info]    Property sourcepath: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/mss/mol/_comp/src/packages
     [wdgen] [Info]    Property targetpath: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/t/64CE6536D7BD962CDCB65DC8A7640047/gen_wdp
     [wdgen] [Info]    Property archivename: sap.commssmol
     [wdgen] [Info]    Property vendor: sap.com
     [wdgen] [Info]    Property dcname: mss/mol
     [wdgen] [Info]    Property projectlanguage: de
     [wdgen] [Info]    Property language: Available languages are automatically determined!
     [wdgen] WARNING: Metadata of component FcLineItemMonitor is not valid! Component "//WebDynpro/Component:com.sap.mss.mol.monitor.FcLineItemMonitor", Role "ComponentController": A minimum of 1 object(s) is required
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView rulename_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView count_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView evaldate [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView evaltime_2 [text]: Context element and property are not compatible
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> TransparentContainer tcActionBar [Children]: Container does not contain children
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> Button btnEditRule [visible]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> Button btnCreateRule [visible]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> Button btnCopyRule [visible]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> Button btnDeleteRule [visible]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> Button btnPersonalize [visible]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView itemtxt_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> LinkToURL verakUser_url [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> LinkToURL verakUser_url [reference]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView itemdate_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView value_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView waers_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> Image confirmedImage [tooltip]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> Image confirmedImage [alt]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> Image confirmedImage [source]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView actionTaken_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView tvCurrency [text]: Context element and property are not compatible
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> TransparentContainer DetailContainer [Children]: Container does not contain children
     [wdgen] [Error]   com.sap.mss.mol.monitor.VcLineItemMonitorView --> UIElement UpdateTrigger [enabled]: Context element and property are not compatible
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView tvStatus: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView evaldate: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView evaltime_2: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> LinkToAction LinkUpdate: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView tvUpdateRunning: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> Caption RuleGroup_Header: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> TextView tvCurrency: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> Caption Details_Header: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.VcLineItemMonitorView --> Caption ItemDetails_Header: UIElement does not have a label
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> TextView rulename_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> TextView ruleid_editor [text]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> InputField inDescription [value]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> CheckBox cbShowAlert [checked]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> DropDownByKey ddKF1 [selectedKey]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> DropDownByKey ddSign [selectedKey]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> InputField inLimitAbs [value]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> DropDownByKey ddAbsRel [selectedKey]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> InputField InputTimestamp [value]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> Tree treeObject [title]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> Tree treeObject [tooltip]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> Tree treeKfspecgl [title]: Context element and property are not compatible
     [wdgen] [Error]   com.sap.mss.mol.monitor.RuleMaintView --> Tree treeKfspecgl [tooltip]: Context element and property are not compatible
     [wdgen] [Info]    com.sap.mss.mol.monitor.RuleMaintView --> Caption tableRulesHeader: UIElement does not have a label
     [wdgen] [Info]    com.sap.mss.mol.monitor.RuleMaintView --> CheckBox cbShowAlert: UIElement does not have a label
     [wdgen] [Warning] com.sap.mss.mol.monitor.RuleMaintView --> DropDownByKey ddSign: UIElement does not have a label
     [wdgen] [Warning] com.sap.mss.mol.monitor.RuleMaintView --> InputField inLimitAbs: UIElement does not have a label
     [wdgen] [Warning] com.sap.mss.mol.monitor.RuleMaintView --> DropDownByKey ddAbsRel: UIElement does not have a label
     [wdgen] [Info]    Catching throwable null
     [wdgen] [Info]    com.sap.webdynpro.generation.ant.GenerationAntTaskError
     [wdgen]      at com.sap.webdynpro.generation.ant.GenerationAnt.showCheckResult(GenerationAnt.java:157)
     [wdgen]      at com.sap.tc.buildcontroller.CBSBuildController.mainLoop(CBSBuildController.java:207)
     [wdgen]      at com.sap.tc.buildcontroller.CBSBuildController.main(CBSBuildController.java:168)
     [wdgen] ERROR: Unknown exception during generation null (com.sap.webdynpro.generation.ant.GenerationAntTaskError)
     [wdgen] ERROR: Generation failed due to errors (7 seconds)
Error: /usr/sap/<SID>/JC51/j2ee/cluster/server0/temp/CBS/27/.B/6448/DCs/sap.com/mss/mol/_comp/gen/default/logs/build.xml:99: [Error]   Generation failed!
     at com.sap.webdynpro.generation.ant.WDGenAntTask.execute(WDGenAntTask.java:254)
     at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275)
     at org.apache.tools.ant.Task.perform(Task.java:364)
     at com.sap.tc.buildcontroller.CBSBuildController.mainLoop(CBSBuildController.java:207)
     at com.sap.tc.buildcontroller.CBSBuildController.main(CBSBuildController.java:168)
Ant runtime 16.597 seconds
Ant build finished with ERRORS
[Error]   Generation failed!
Error: Build stopped due to an error: [Error]   Generation failed!
Build plugin finished at 2008-11-28 22:04:32 GMT-07:00 (MST)
Total build plugin runtime: 20.648 seconds
Build finished with ERROR
What can be done to resolve these error and trigger the build again.
Bhavin

Resloved with SAP help.
1. Ran configuration wizard for CBS, CMS & DTR
2. Changes few JVM parameters (increased heap size, jdbc pool size)

How to refer Custom css from the custom file say xxcm_sc_custom.xss

I want to refer all the custom css from other file xxcm_sc_custom.xss, which i created in my project directory and deployed in mds, The client wants all the css to be here, so how to refer this file from custom.xss file which is in java_top, i tried giving <import href="path of my file"> but there is no effect in pages, what are the exact steps for it...
Thanks
Babu

Yes, thats what i tried first...can you tell me what am i doing wrong...
This is the header part of my login page template which i am trying to edit...
The default css that the page is using is theme_3_1.css. My css file and images are in the same directory as theme_3_1.css
<html lang="&BROWSER_LANGUAGE." xmlns:htmldb="http://htmldb.oracle.com">
<head>
<title>#TITLE#</title>

#HEAD#
<link rel="stylesheet" href="#IMAGE_PREFIX#themes/theme_20/mystylesheet.css" type="text/css">
<link rel="stylesheet" href="#IMAGE_PREFIX#themes/theme_20/theme_3_1.css" type="text/css">
</head>
It is not pulling my images.
I know my html is right, because, if i create a separate html file (away from apex) and use the above two css, again on the same directory..i am able to get the images displayed!!!!

Changing a style in xss depending on the facet

Is it possible to change a style in the xss depending on the facet?
I want to change in my UIX application the prompt style of the messageTextInput components - not the contentStyle - for example underline the prompts. But I want this to happen only if facet==printable.
Can I change this once in an xss and apply it to the whole application? I know I should change the OraPromptsomething (I've found the correct one, I just don't have its name here) - but I don't know how to change it depending on the facet

So I suppose it is not possible?

How to enable auditor in BO XI 3.1

Hi Experts,
I have BO XI 3.1 installed in Sun Solaris OS working fine. I want to enable auditor and use these features. How can i do it as i don't find document for BO XI3.1 auditor.
Regards,
Suresh

Check the admin guide:
http://help.sap.com/businessobject/product_guides/boexir31/en/xi3-1_bip_admin_en.pdf
Look at the Managng auditing section.
Have you setup already the DB connection for the auditing?
Assuming you have done this all you have to do is to go into the CMC and under Servers activate the auditing for the individual services (Select Auditing events in the Properties panel)
Regards,
Stratos

XSS Auditor

Similar Messages

Maybe you are looking for