rootvector2 commented on PR #771: URL: https://github.com/apache/commons-vfs/pull/771#issuecomment-4897363871
did the deeper sweep across the rest of the live commons components. the only other place with this same wire-name-to-instantiation shape is `commons-net`'s `DefaultFTPFileEntryParserFactory`, and it's already hardened the same way: `Class.forName(key, false, loader)` with an `isAssignableFrom` gate before construction, plus a comment noting the untrusted `SYST` reply. everything else that calls `Class.forName`/`loadClass` and instantiates is driven by app-authored config/rules, a code literal, a caller-supplied `Class`, or an `ObjectInputStream` `resolveClass` override, not a class name off the wire. so nothing else to patch under this pattern. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
