rootvector2 opened a new pull request, #501:
URL: https://github.com/apache/commons-bcel/pull/501
comparing `createConstant` (which escapes string `LDC` operands via
`Utility.convertString`) against the sibling
`createNew`/`createFieldAccess`/`createInvoke` emitters shows those write
referenced class, field and method names raw, so a crafted constant-pool name
such as `foo"); exec(...); il.append("` breaks out of the generated string
literal and injects code into the `BCELifier` output, which the same helper now
prevents.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
