Security violations max length

Eximee Platform
1

I got exception in Eximee logs

Security violations found in service params: SecurityValidationResult(violations=[ServiceSecurityViolation(super=SecurityViolation(exceptionMessage=Param string length (281) exceeded the hard limit (256), level=WARN, validationMessageKey=IEW_SECURITY_MAX_LENGTH), serviceName=callServiceProxy)])

Even when I changed configurations

<*****ServiceProxy>    
          <enabled>true</enabled>
         <maxLength>1024</maxLength>   
         <extraWhitelistCharacters><![CDATA[{}[]=\\/:"&+()'._<>]]></extraWhitelistCharacters>  
  </*****ServiceProxy>
2

Hi

Provided configuration looks fine and maxLength should work, but log says otherwise. So my guess is that:

  • there might be typo in service name in Your configuration or in code which attempts to call service,

  • configuration might be misplaced. Service configuration should be placed in webforms.server.securityValidation.services in webforms.xml.

Provided log contains serviceName callServiceProxy. This is default service name used when the provided one was not found in configuration or it is not enabled (enabled tag is missing or it is set to false). Another sign of missing/invalid configuration is part with hard limit (256), 256 is default value when no configuration is found.

3

One more thing, it is important to add this configuration not only in current configuration but also in installation bundle. As configuration from bundle overrides existing one.