Rishabh Daim created JCRVLT-877:
-----------------------------------
Summary: Remote child named .vlt overwrites the working-copy
control zip under vlt up --force
Key: JCRVLT-877
URL: https://issues.apache.org/jira/browse/JCRVLT-877
Project: Jackrabbit FileVault
Issue Type: Bug
Reporter: Konrad Windszus
Assignee: Konrad Windszus
Fix For: 3.2.10, 4.3.0
Package configuration files (config.xml) can name any Java class, and the
software loads that class as soon as a package is opened, before permissions
are checked. A crafted package could abuse this to run code on the server. The
fix allows only approved filter types and blocks a syntax that reads class
values directly. Built-in configurations don't use these features, so nothing
shipped should break.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
