garydgregory commented on code in PR #446:
URL: https://github.com/apache/commons-cli/pull/446#discussion_r4407679423
##########
src/main/java/org/apache/commons/cli/PatternOptionBuilder.java:
##########
@@ -35,15 +35,15 @@ Licensed to the Apache Software Foundation (ASF) under one
or more
* </tr>
* <tr>
* <td>b@</td>
- * <td>-b [class name]</td>
+ * <td>-b [class name] (creates object via empty constructor)</td>
Review Comment:
```suggestion
* <td>-b [class name] (creates object via public no-argument
constructor)</td>
```
##########
src/main/java/org/apache/commons/cli/PatternOptionBuilder.java:
##########
@@ -69,6 +69,11 @@ Licensed to the Apache Software Foundation (ASF) under one
or more
* </pre>
*
* <p>
+ * The {@code @} and {@code +} codes load the class named by the option value,
and {@code @} also creates an instance by calling its public no-argument
+ * constructor. Do not use these codes for values from an untrusted source.
+ * </p>
Review Comment:
```suggestion
* When a converted option value is retrieved, for example through {@link
CommandLine#getParsedOptionValue(String)}, the {@code @} and {@code +} codes
* load the class named by the option value, and {@code @} also creates an
instance by calling its public no-argument constructor. Do not use these codes
* for values from an untrusted source.
* </p>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
