[
https://issues.apache.org/jira/browse/ARTEMIS-4763?focusedWorklogId=918170&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-918170
]
ASF GitHub Bot logged work on ARTEMIS-4763:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 07/May/24 19:34
Start Date: 07/May/24 19:34
Worklog Time Spent: 10m
Work Description: cshannon commented on PR #4924:
URL:
https://github.com/apache/activemq-artemis/pull/4924#issuecomment-2099159700
> In general we have learned through a number of security reports that
blindly creating any class instance is usually not the greatest idea. It would
be beneficial to at least scope the class created to an instance of an expected
type, the test seems to be creating Transformer types to validating that before
newInstance somehow would be beneficial.
The other big one that seems to pop up a lot is java serialization CVEs,
basically the same issue... allowing instantiation of Java objects without
validation that the type isn't something malicious
Issue Time Tracking
-------------------
Worklog Id: (was: 918170)
Time Spent: 40m (was: 0.5h)
> properties config - support metrics plugin, conversion of .class for non
> string attributes and empty init
> ----------------------------------------------------------------------------------------------------------
>
> Key: ARTEMIS-4763
> URL: https://issues.apache.org/jira/browse/ARTEMIS-4763
> Project: ActiveMQ Artemis
> Issue Type: New Feature
> Components: Configuration
> Affects Versions: 2.33.0
> Reporter: Gary Tully
> Assignee: Gary Tully
> Priority: Major
> Time Spent: 40m
> Remaining Estimate: 0h
>
> the metrics plugin is not a broker plugin, so cannot be initialised via the
> broker plugins collection. We can only add .class instances to collections.
> The metrics instance is an attribute that needs a class type argument on the
> metrics configuration.
> supporting a conversion to any non string scalar type using a .class value
> will work nicely.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
