Is Seam.Remoting.eval() secure?

[dro_k]

Can't a malicious user import the seam/remoting/resource/remote.js and use Seam.Remoting.eval() to bypass @WebRemote restrictions and call any arbitrary method? This can be a very serious security hole, even if Seam Remoting is not enabled (by marking any components using @WebRemote). I wonder how many Seam based sites are vulnerable to this sort of attack??

[shane.bryzak]

This feature was disabled until we can find a way for expression evaluations to honour the @WebRemote annotation.

[dro_k]

Good call... it's pretty unsecure otherwise. Is there a JIRA for this so I can keep track of it?

[shane.bryzak]

There's no JIRA, but it's on my personal to-do list.  Feel free to create an issue in JIRA if you like.