Exploiting CSRF against search with Lucene

So the article suggests using a timkng attack on a Lucene searchbox to determine if an item exists or not (at least thats what I gather).<p>Considering most likely the searchbox will already tell youif something exists, whats the purpose?<p>I think I&#x27;m missing something here.

Lucene has no HTTP interface of its own. This is not a Lucene security issue.

Another excellent reason to write your own query parser instead of using Lucene&#x27;s. Lucene&#x27;s query parser is way too powerful to expose to end users.