Return-Path: X-Original-To: apmail-commons-issues-archive@minotaur.apache.org Delivered-To: apmail-commons-issues-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 9DE9810EFC for ; Thu, 1 May 2014 03:56:24 +0000 (UTC) Received: (qmail 85867 invoked by uid 500); 1 May 2014 03:56:21 -0000 Delivered-To: apmail-commons-issues-archive@commons.apache.org Received: (qmail 85509 invoked by uid 500); 1 May 2014 03:56:18 -0000 Mailing-List: contact issues-help@commons.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: issues@commons.apache.org Delivered-To: mailing list issues@commons.apache.org Received: (qmail 85501 invoked by uid 99); 1 May 2014 03:56:15 -0000 Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28) by apache.org (qpsmtpd/0.29) with ESMTP; Thu, 01 May 2014 03:56:15 +0000 Date: Thu, 1 May 2014 03:56:15 +0000 (UTC) From: "Yoshitaka Kawashima (JIRA)" To: issues@commons.apache.org Message-ID: In-Reply-To: References: Subject: [jira] [Commented] (BEANUTILS-463) Class loader vulnerability in DefaultResolver MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394 [ https://issues.apache.org/jira/browse/BEANUTILS-463?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13986325#comment-13986325 ] Yoshitaka Kawashima commented on BEANUTILS-463: ----------------------------------------------- I wrote this article. http://qiita.com/kawasima/items/670d2591bc8fea19dc1d Considering CVE-2014-0114, It'd be great if the "class" keyword don't be regarded as a bean property in DefaultResolver. As follows: https://gist.github.com/nakamura-to/11347570 But considering the wide-ranging impact, I think it's okay to build the alternative resolver like the above one into the commons-beanutils. > Class loader vulnerability in DefaultResolver > --------------------------------------------- > > Key: BEANUTILS-463 > URL: https://issues.apache.org/jira/browse/BEANUTILS-463 > Project: Commons BeanUtils > Issue Type: Improvement > Components: Expression Syntax > Affects Versions: 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.9.0, 1.9.1 > Reporter: Patrick Trainor > > There is no check for the "class" keyword when getting nested properties. Please see here (and translate it) for a more detailed explanation: > http://qiita.com/kawasima/items/670d2591bc8fea19dc1d -- This message was sent by Atlassian JIRA (v6.2#6252)