Mailing-List: contact issues-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: issues@commons.apache.org
Date: Mon, 22 Jul 2013 06:48:48 +0000 (UTC)
From: "Lukasz Lenart (JIRA)" <jira@apache.org>
To: issues@commons.apache.org
Message-ID: <JIRA.12659007.1374464082374.89148.1374475728759@arcas>
In-Reply-To: <JIRA.12659007.1374464082374@arcas>
References: <JIRA.12659007.1374464082374@arcas>
Subject: [jira] [Commented] (OGNL-237) disable construct object using new
 for security
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/OGNL-237?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13714950#comment-13714950 ] 

Lukasz Lenart commented on OGNL-237:
------------------------------------

OGNL is general purpose Expression Language, so I don't see point to disable that "feature". If someone used hammer in improper way, you cannot blame hammer for that ;-)
                
> disable construct object using new for security
> -----------------------------------------------
>
>                 Key: OGNL-237
>                 URL: https://issues.apache.org/jira/browse/OGNL-237
>             Project: Commons OGNL
>          Issue Type: Improvement
>            Reporter: zhouyanming
>            Priority: Critical
>
> struts2 is suffering security vulnerability caused by ognl
> I don't know who would like to new objects in expression,if it must be left for compatibility,please build a blacklist for java.xxx and javax.xxx

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira