JR48124: Cookie validation fails when integrating Sterling Configurator with WebSphere Commerce

APAR status

• Closed as program error.

Error description

• When integrating Sterling Configurator and Visual Modeler with
  WebSphere Commece, the following error might be thrown when
  performing certain actions in Visual Modeler, such as previewing
   a model.
  
  The following error can be seen in the Sterling debs.log:
  
  2013-06-27 16:31:25,389:WARN :WebContainer : 3: SECURITY-FAILURE
  - Input does not conform to pattern: context=Cookie value
  (Name:WC_PERSISTENT)...  ... ... pattern=^[a-ZA-Z0-9.!\-\/+=_
  :\^]*$, Input=... ... ...
    ValidationException @
  com.sterlingcommerce.security.dv.SCValidationException.<init>(SC
  ValidationException.java:76)
    [WCIntegrationUser]: DataValidationLogger
    ...
  

Local fix

• Bypass the request validation (not recommended).
  In the sic.war web.xml file, add the following context parameter
  (after the request.validation.bypass.uri.yfc.7 context
  parameter).
  <context-param>
   <param-name>request.validation.bypass.uri.sic.1</param-name>
   <param-value>/configurator/configure.action</param-value>
  </context-param>
  

Problem summary

• USERS AFFECTED:
  WebSphere Commerce users on v7.0 who are integrating with
  Sterling Configurator and Visual Modeler
  
  PROBLEM ABSTRACT:
  Cookie validation fails when integrating Sterling Configurator
  with WebSphere Commerce
  
  BUSINESS IMPACT:
  Business users are unable to preview models
  
  RECOMMENDATION:
  

Problem conclusion

• The following properties files are updated to allow the cookie
  validation checks to pass:
  
  SterlingCommerceConfigurator.jar/sic_InputType_ValidationRules_e
  xtn.properties
  SterlingCommerceConfigurator.jar/sic_ParamValue_ValidationRules
  extn.properties
  
  
  -------------------------------------------------------------
  The latest available maintenance information can be obtained
  from the Recommended Fixes for WebSphere Commerce technote:
  http://www.ibm.com/support/docview.wss?rs=3046&uid=swg21261296
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WC BUS EDITION

• Fixed component ID

  5724I3800

Applicable component levels

• R700 PSY

     UP