Security bug with FacesContext in application startup

eclipse-faces-bot commented 12 years ago

Regarding the FacesContext that is available during application initialization, we need some language in the spec about how it is cleaned up. Otherwise, it can leak into the initialization thread of another application and allow one WAR to see the context of another WAR.

Also, we need some language saying that FacesContext.getCurrentInstance() should always return null except when: A) We are in the context of a servlet request, or B) We are receiving a PostConstructApplicationEvent

See http://java.net/jira/browse/JAVASERVERFACES-2436 for full details and an application that recreates the issues.

eclipse-faces-bot commented 5 years ago

Issue Imported From: https://github.com/javaee/javaserverfaces-spec/issues/1112
Original Issue Raised By:@glassfishrobot
Original Issue Assigned To: Unassigned

eclipse-faces-bot commented 12 years ago

@glassfishrobot Commented Reported by ssilvert

eclipse-faces-bot commented 10 years ago

@glassfishrobot Commented @edburns said: Set priority to baseline ahead of JSF 2.3 triage. Priorities will be assigned accurately after this exercise.

eclipse-faces-bot commented 7 years ago

@glassfishrobot Commented This issue was imported from java.net JIRA JAVASERVERFACES_SPEC_PUBLIC-1112

jakartaee / faces

Security bug with FacesContext in application startup #1112