{"action":"opened","issue":{"url":"https://api.github.com/repos/wocommunity/wonder/issues/768","repository_url":"https://api.github.com/repos/wocommunity/wonder","labels_url":"https://api.github.com/repos/wocommunity/wonder/issues/768/labels{/name}","comments_url":"https://api.github.com/repos/wocommunity/wonder/issues/768/comments","events_url":"https://api.github.com/repos/wocommunity/wonder/issues/768/events","html_url":"https://github.com/wocommunity/wonder/issues/768","id":161010719,"number":768,"title":"AjaxFlexibleFileUpload uses AjaxProxy without setting proxy binding","user":{"login":"paulhoadley","id":891519,"avatar_url":"https://avatars.githubusercontent.com/u/891519?v=3","gravatar_id":"","url":"https://api.github.com/users/paulhoadley","html_url":"https://github.com/paulhoadley","followers_url":"https://api.github.com/users/paulhoadley/followers","following_url":"https://api.github.com/users/paulhoadley/following{/other_user}","gists_url":"https://api.github.com/users/paulhoadley/gists{/gist_id}","starred_url":"https://api.github.com/users/paulhoadley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paulhoadley/subscriptions","organizations_url":"https://api.github.com/users/paulhoadley/orgs","repos_url":"https://api.github.com/users/paulhoadley/repos","events_url":"https://api.github.com/users/paulhoadley/events{/privacy}","received_events_url":"https://api.github.com/users/paulhoadley/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-06-18T06:52:32Z","updated_at":"2016-06-18T06:52:32Z","closed_at":null,"body":"As I noted in a comment in #731, it seems that `AjaxFlexibleFileUpload` uses `AjaxProxy` without setting `proxy` binding, thus having the proxy object set to the parent `WOComponent`. @lbane notes:\r\n\r\n> `AjaxProxy` currently publishes **every** public method of the object on the client side. For components this means for example `WOComponent.valueForKeyPath` and `WOComponent.takeValueForKeyPath` are directly callable by the client. A malicious user may call `valueForKeyPath(\"application.terminate\")` or every other path reachable by session or application. I call this a serious issue.\r\n\r\nI'm coming to this simply as a user of `AjaxFlexibleFileUpload` (via `ERAttachmentFlexibleUpload`)—I don't know how that component works, or even what it's doing with `AjaxProxy`. I'm happy to start looking into this, but if the solution here is obvious to someone, by all means chime in."}}
{"actor":{"display_login":"paulhoadley"}}