janrain/janrain-backplane-2 — pull request #28 by geokat (2013-01-22 00:12:44+00:00)
Title: FED-127: disable JSP expression language support

http://support.springsource.com/security/cve-2011-2730

The codebase does not seem to contain any code that makes us
vulnerable to this, but we want to protect ourselves anyway.

Testing instructions:
Paste the following code into a JSP file (e.g. admin.jsp):

<%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %>

Open the page in the browser, passing it a valid EL expression as `foo`:

http://localhost:8080/backplane-server/admin?foo=${requestScope}

Without this change, Spring will evaluate the parameter and dump the
contents of `requestScope` on the page. With this change,
`${requestScope} should be displayed instead.