PI20210: REQUEST'S PARAMETERS CAN BE MODIFIED BY THE APPLICATION (VIA STRING OBJECT MODIFICATION).

8.5.5.4: WebSphere Application Server V8.5.5 Fix Pack 4
8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• Request's parameters can be modified by the application.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server Full       *
  *                  Profile versions  8.5.5 and Liberty         *
  *                  Profile version 8.5.5                       *
  ****************************************************************
  * PROBLEM DESCRIPTION: The                                     *
  *                      javax.servlet.ServletRequest.getParamet *
  *                      erValues() method could return wrong    *
  *                      values                                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The javax.servlet.ServletRequest.getParameterValues() method
  returns an array of String of the request parameter values.
  If this array of String is modified directly, it can alter the
  original request parameter values.  Any subsequent call to
  javax.servlet.ServletRequest.getParameterValues() method
  returns the modified values.
  

Problem conclusion

• The WebContainer code was modified to correct the problem.
  
  A new WebContainer customer property needs to be set to enable
  the behavior provided by this APAR:
  
  com.ibm.ws.webcontainer.preserveRequestParameterValues = true
  (default is false)
  
  Please refer to the following technote for instructions on
  enabling WebContainer custom properties:
  
  
  Full Profile:
  http://www.ibm.com/support/docview.wss?rss=180&uid=swg21284395
  
  Liberty Core:
  http://www-01.ibm.com/support/docview.wss?uid=swg21597753
  
  The fix for this APAR is currently targeted for inclusion in
  fixpack 8.5.5.4.
  
  Please refer to the recommended updates page for delivery
  information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels

• R850 PSY

     UP