[
https://issues.apache.org/jira/browse/JCRVLT-862?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132377#comment-18132377
]
Rishabh Daim commented on JCRVLT-862:
-------------------------------------
Fixed in 3.2.x ->
https://github.com/apache/jackrabbit-filevault/commit/3acd768acf29b2b9460994f7790f88069e60c635
> Restrict "config.xml" includes/excludes to ItemFilter's only
> ------------------------------------------------------------
>
> Key: JCRVLT-862
> URL: https://issues.apache.org/jira/browse/JCRVLT-862
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Konrad Windszus
> Priority: Major
> Fix For: 3.2.10, 4.3.0
>
>
> Package configuration files (config.xml) can name any Java class, and the
> software loads that class as soon as a package is opened, before permissions
> are checked. A crafted package could abuse this to run code on the server.
> The fix allows only approved filter types and blocks a syntax that reads
> class values directly. Built-in configurations don't use these features, so
> nothing shipped should break.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
