rootvector2 commented on PR #771:
URL: https://github.com/apache/commons-vfs/pull/771#issuecomment-4897363871

   did the deeper sweep across the rest of the live commons components. the 
only other place with this same wire-name-to-instantiation shape is 
`commons-net`'s `DefaultFTPFileEntryParserFactory`, and it's already hardened 
the same way: `Class.forName(key, false, loader)` with an `isAssignableFrom` 
gate before construction, plus a comment noting the untrusted `SYST` reply. 
everything else that calls `Class.forName`/`loadClass` and instantiates is 
driven by app-authored config/rules, a code literal, a caller-supplied `Class`, 
or an `ObjectInputStream` `resolveClass` override, not a class name off the 
wire. so nothing else to patch under this pattern.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to