[
https://issues.apache.org/jira/browse/JCRVLT-862?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Konrad Windszus updated JCRVLT-862:
-----------------------------------
Security: (was: Private)
> Restrict "config.xml" includes/excludes to ItemFilter's only
> ------------------------------------------------------------
>
> Key: JCRVLT-862
> URL: https://issues.apache.org/jira/browse/JCRVLT-862
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Konrad Windszus
> Priority: Major
> Fix For: 4.3.0
>
>
> Package configuration files (config.xml) can name any Java class, and the
> software loads that class as soon as a package is opened, before permissions
> are checked. A crafted package could abuse this to run code on the server.
> The fix allows only approved filter types and blocks a syntax that reads
> class values directly. Built-in configurations don't use these features, so
> nothing shipped should break.
> https://github.com/apache/jackrabbit-filevault-private/issues/5
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
