[
https://issues.apache.org/jira/browse/JCRVLT-862?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Julian Reschke updated JCRVLT-862:
----------------------------------
Description: Package configuration files (config.xml) can name any Java
class, and the software loads that class as soon as a package is opened, before
permissions are checked. A crafted package could abuse this to run code on the
server. The fix allows only approved filter types and blocks a syntax that
reads class values directly. Built-in configurations don't use these features,
so nothing shipped should break. (was: Package configuration files
(config.xml) can name any Java class, and the software loads that class as soon
as a package is opened, before permissions are checked. A crafted package could
abuse this to run code on the server. The fix allows only approved filter types
and blocks a syntax that reads class values directly. Built-in configurations
don't use these features, so nothing shipped should break.
https://github.com/apache/jackrabbit-filevault-private/issues/5)
> Restrict "config.xml" includes/excludes to ItemFilter's only
> ------------------------------------------------------------
>
> Key: JCRVLT-862
> URL: https://issues.apache.org/jira/browse/JCRVLT-862
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Konrad Windszus
> Priority: Major
> Fix For: 4.3.0
>
>
> Package configuration files (config.xml) can name any Java class, and the
> software loads that class as soon as a package is opened, before permissions
> are checked. A crafted package could abuse this to run code on the server.
> The fix allows only approved filter types and blocks a syntax that reads
> class values directly. Built-in configurations don't use these features, so
> nothing shipped should break.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
