Question around the richfaces scripts and styles

[umesh.sehgal]

Hi,

I'm using richfaces components in my application and I see that with every Ajax request made to the server, the response contains a specific script and stylesheet ( /richfaces/renderkit/html/scripts/tooltip.js.jsf and /richfaces/renderkit/html/css/tooltip.xcss/DATB/eAF7sqpgb-jyGdIAFrMEaw__.jsf), but I'm not sure what they are for.

Can someone please put some light on what these artifacts are for and if it would make any difference if under certain cases these are not included in response.

The reasons I want to know this is because, when we run a penetration testing tool against our application, under one specific scenario these two artifacts are not part of the response, and because of that the tool reports the web page as vulnerable to security break.We really need to figure out as why these artifacts go missing in that response

Any help would be highly appreciated.

Thanks,

Umesh

[iabughosh]

hello Umesh,

i think the style and js files for some component are loaded lazily , for example if one page contains rich:tooltip then it's js & styles are loaded, if there is no tooltip in your page then no unnecessary styles and js  being loaded.

regards.

[umesh.sehgal]

Thanks Ibrahim,

But we are not using tooltip component on that page, so why it's load it then.

Structure is as follows:

Main.jsf -> has two tabs (profile.jsf and account.jsf)

Profile.jsf doesn't have any tooltip

Account.jsf uses rich:tooltip

But then even when I'm on Profile.jsf, I see tooltip related scripts and styles being loaded, not sure if that's the intended behavior.

Also, even if I assume it's the correct behavior, then not sure why it just doesn't load this script and style for a specific input, could this be affected anyways if there are some suspicious character present in the input string?

[iabughosh]

is your rich:tabPanel switchType value "client" ?., could you please try your tests without the tabs ?, thank you.

[umesh.sehgal]

No, switchType is set to default. I did try removing the tab which includes rich:tooltip and I could see the response no longer contained those script and style.

[iabughosh]

with switchType="server" i expect the same result.

[umesh.sehgal]

meaning if switchType="server", it would load all the scripts everytime.

Also, is it possible to somehow get some insight as how richfaces library determines to include a script/style in response? This would really help understand as under what conditions it could skip including these artifacts in response.

Thanks.