The current state of JComponentHelper

[klas berlič]

My 5 cents on JComponent helper returning wrong results:

I originally sent this report to the JSST on 26.7.11, never got any reply about its content, just standard thank you note. Sent it to JSST as wrong output of this function combined with vulnerable extension could be a potential danger - but after more than one year I think it is safe to claim they decided it is not an issue so I presume my findings are safe to publish.

====================================================

Clarification for the result column:

• OK - component renders,
• NOT_FOUND - system returns COMPONENT NOT FOUND status
• Marked by red fields are results when under specified conditions component renders  when it should indeed return NOT_FOUND. 
  
• Orange marks conditions when issue is a functional bug, but IMHO not a security problem.
  

Such wrong behavior of  JComponentHelper in my opinion becomes a security issue if someone relies on Disable to prevent unsafe users from accessing vulnerable component (backend - second red OK) or when vulnerable component is deinstalled from a database (== not installed) but files remain there (e.g. due to file permission problems) - this is valid from the frontend and marked as first red OK n the results.

Not exactly a release triggering issue, but surely a bug that should be fixed.

Regards,
Klas