rzo1 opened a new pull request, #1078: URL: https://github.com/apache/opennlp/pull/1078
Backport of #1021 to `opennlp-1.x`. ## Problem `ExtensionLoader` resolved arbitrary class names through `Class.forName()`, which executes the static initializers of untrusted classes (CWE-470) loaded from model manifests. ## Fix - Only classes whose fully-qualified name starts with a registered package prefix may be instantiated. The default prefix is `opennlp.`. - Additional prefixes can be added via `ExtensionLoader.registerAllowedPackage(String)` or the `OPENNLP_EXT_ALLOWED_PACKAGES` system property (comma-separated). - `unregisterAllowedPackage(String)` removes a prefix. - The allowlist gate runs **before** `Class.forName()`. - Prefixes are dot-normalized so `com.acme` cannot be exploited via `com.acmeevil.*`. ## 1.x adaptations vs. the 2.x change - Java 8: `trim().isEmpty()` instead of `String.isBlank()`. - Tests ported from JUnit 5 to JUnit 4. - The existing OSGi loading path is preserved. - Docs (`extension.xml`) updated in DocBook 4.4 form. Tests: `ExtensionLoaderTest` (12) pass on Temurin JDK 8. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
