sergehuber opened a new pull request, #877: URL: https://github.com/apache/unomi/pull/877
## Summary - Keep MVEL enabled (same as 3.0). Existing `script::` expressions still compile. - Always deny the public MVEL eval APIs from the scripting class loader, including inner-class, array, slash, and zero-width name forms. - Tighten forbid-pattern matching after invisible-character stripping. Request sanitizing is not treated as the control that must enumerate every prefix encoding. ## Test plan - [ ] `SecureFilteringClassLoaderTest` - [ ] `ExpressionFilterTest` - [ ] `MvelScriptExecutorTest` - [ ] CI -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
