On Thu, Jul 18, 2013 at 12:50 AM, Security Explorations <cont...@security-explorations.com> wrote: > > Hello All, > > We discovered yet another indication that new Reflection API introduced > into Java SE 7 was not a subject to a thorough security review (if any). I'm kind or surpised some of these bugs exist for so long. Allowing them to fester and rot can't be good (I have not been able to come up with a use case where it is desired or preferred).
Does anyone know anything about Oracle's engineering process? What is Oracle doing to ensure issues are tracked and remediated in reasonable time? What does the process include for code scanning to catch low hanging fruit? Are they using Find Bugs or Coverity (I checked scan.coverity.com, and I did not see Oracle Java or OpenJDK listed, so I wonder if they are doing it internally). What is the QA process doing to ensure items with negative impact are not allowed to pass? Jeff
