danielfernandez
commented
2 years ago Thanks. This was caused by an issue with unbalanced parentheses in selectors in the AttoParser library, now fixed in version 2.0.6.
Also, as for this code:
@Controller
public class InjectionController {
@GetMapping("/tryInjection")
public String tryInjection(String fragment) {
return "index::" + fragment;
}
}Please note that it would be never recommended that an application uses direct user input (a request parameter in this case) as a template or fragment selector without previous validation. This kind of user code could have undesirable security implications like the ones seen in this case, allowing an issue in the underlying software to be triggered by external users.
Hi,
Thymeleaf & thymeleaf-spring5 : 3.0.15.RELEASE Spring boot version : 2.5.13 Java : 8
I found that once a "Markup Selectors" can be injected with odd number of single quote, a denial of service would be cause.
Example:
Controller
Once I visit this path with parameter that have odd number of single quote, for example:
http://localhost:8080/tryInjection?fragment=a'b'c'a thread will enter an endless loop. After several times, the app will denial all service.
The thread dump was like this: