commons-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Adrian Cumiskey (Updated) (JIRA)" <>
Subject [jira] [Updated] (OGNL-23) Class.forName() usage is malicious inside OSGi
Date Sat, 22 Oct 2011 01:08:32 GMT


Adrian Cumiskey updated OGNL-23:

    Attachment: patch-OGNL23.txt

This is a patch file which I believe should satisfy the issue.

All references to Class.forName() have been replaced with calls to OgnlContext.DEFAULT_CLASS_RESOLVER.classForName().
 This method also previously used Class.forName and now it uses ClassLoader.loadClass().

Cheers, Adrian.
> Class.forName() usage is malicious inside OSGi
> ----------------------------------------------
>                 Key: OGNL-23
>                 URL:
>             Project: OGNL
>          Issue Type: Bug
>            Reporter: Simone Tripodi
>         Attachments: patch-OGNL23.txt
> {{Class.forName()}} could make OGNL unusable [inside OSGi|].
> The fix would involve the {{ClassLoader.loadClass()}} method, allowing users setting
a custom {{ClassLoader}
> Classes affected by that issues are:
>  * {{org.apache.commons.ognl.DefaultClassResolver}}
>  * {{org.apache.commons.ognl.OgnlRuntime}}
> The {{org.apache.commons.ognl.ASTMap}} class is affected as well, even if loading {{java.util.LinkedHashMap}}
in that way should be safe.

This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:!default.jspa
For more information on JIRA, see:


View raw message