Raymond Camden's Blog Rss

Followup on ColdFusion 9/Solr Post

4

Posted in ColdFusion | Posted on 08-21-2009 | 3,855 views

Just a very quick follow up to my post yesterday about ColdFusion and Solr. (And by the way - I'm disappointed no one has discovered the security issue with my searchable code. Tsk tsk! :) I ran into issues running Solr when I was testing. Shannon Hicks has posted a nice blog entry on this with Mac-compatible Solr startup scripts:

ColdFusion 9 Solr Startup Scripts for OSX

Thanks Shannon!

Comments

[Add Comment] [Subscribe to Comments]

Gary Gilbert said on 08-22-2009 at 9:45 AM #
you mean the cfoutput #form.search# thats open to xss attacks?

It's example code demonstrating slor functionality not on how to protect against xss. Anyone who uses example code in a production environment (e.g. cut and paste coding) deserves what he or she gets.

Perhaps a bit harsh but thats my opinion
Raymond Camden said on 08-22-2009 at 9:48 AM #
Good one, but not it. The flaw is explicitly related to search. You are the only one who tried, so if you want, I can just spill it. :)
Gary Gilbert said on 08-22-2009 at 1:35 PM #
Ray, other than you not cleaning your url or form variable in search.cfm I don't see any other security problems. I must be losing my edge.
Raymond Camden said on 08-22-2009 at 3:37 PM #
You know, I made this too obtuse probably. And overblown. I apologize. Really - the issue was simple. The 'old' app used logic to get PRs with a published date in the past. That logic is not respected in search. It is a classic example really of where a security/business rule in one place gets missed in another.