rootvector2 commented on PR #771: URL: https://github.com/apache/commons-vfs/pull/771#issuecomment-4897012878
the real win isn't the `Exception` gate, it's dropping the one-arg `Class.forName`. that form initializes whatever class the server names, so a hostile server can fire any class's static initializer just by naming it, before any `instanceof` check runs. `Class.forName(name, false, loader)` stops that, and the type gate keeps construction from invoking arbitrary `String` constructors. you're right that a server can still get an `Exception` subtype loaded and constructed, so this narrows the surface rather than closing it. if the complication isn't worth it, the cleaner move is to drop the reflective instantiation entirely. the named class is the server's own exception type and rarely resolves on a client classpath, so today it mostly just falls through to `ClassNotFoundException`. happy to cut it down to building the `FileSystemException` from the message if you'd rather not carry the reflection at all. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
