[jira] [Commented] (COLLECTIONS-580) Arbitrary remote code execution with InvokerTransformer

2015-11-19 Thread Thomas Neidhart (JIRA)
[ https://issues.apache.org/jira/browse/COLLECTIONS-580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013112#comment-15013112 ] Thomas Neidhart commented on COLLECTIONS-580: - Hmm I feared that it would be too easy to

[jira] [Commented] (MATH-1293) Tabulating the logarithmic factorial

2015-11-19 Thread Aleksei Dievskii (JIRA)
[ https://issues.apache.org/jira/browse/MATH-1293?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013226#comment-15013226 ] Aleksei Dievskii commented on MATH-1293: At that moment, no. I was operating under assumption that

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Kristian Rosenvold (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014025#comment-15014025 ] Kristian Rosenvold commented on IO-487: --- Yes please ! > ValidatingObjectInputStream contribution -

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014017#comment-15014017 ] Bertrand Delacretaz commented on IO-487: Ran the Cobertura coverage with "mvn site",

[jira] [Updated] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Description: As discussed on the commons dev list I'd like to contribute my SLING-5288 code to

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014417#comment-15014417 ] Bertrand Delacretaz commented on IO-487: bq. If you have to declare any accepted class, you might be

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014154#comment-15014154 ] Bertrand Delacretaz commented on IO-487: Done, http://svn.apache.org/r1715240 >

[jira] [Closed] (LANG-1181) MultilineRecursiveToStringStyle is not public

2015-11-19 Thread Henri Yandell (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1181?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Henri Yandell closed LANG-1181. --- Resolution: Duplicate > MultilineRecursiveToStringStyle is not public >

[jira] [Commented] (LANG-1178) ArrayUtils.removeAll(Object array, int... indices) should do the clone, not its callers

2015-11-19 Thread ASF GitHub Bot (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1178?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014472#comment-15014472 ] ASF GitHub Bot commented on LANG-1178: -- GitHub user hyandell opened a pull request:

[jira] [Commented] (COLLECTIONS-580) Arbitrary remote code execution with InvokerTransformer

2015-11-19 Thread Thomas Neidhart (JIRA)
[ https://issues.apache.org/jira/browse/COLLECTIONS-580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014694#comment-15014694 ] Thomas Neidhart commented on COLLECTIONS-580: - In the collections4 branch, the

[GitHub] commons-lang pull request: Moving the clone inside removeAll(Objec...

2015-11-19 Thread hyandell
GitHub user hyandell opened a pull request: https://github.com/apache/commons-lang/pull/116 Moving the clone inside removeAll(Object,int...);Object per LANG-1178 You can merge this pull request into a Git repository by running: $ git pull

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Emmanuel Bourg (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014580#comment-15014580 ] Emmanuel Bourg commented on IO-487: --- What about trusting {{java.lang}} by default? >

[jira] [Commented] (COLLECTIONS-580) Arbitrary remote code execution with InvokerTransformer

2015-11-19 Thread Stevie Beck (JIRA)
[ https://issues.apache.org/jira/browse/COLLECTIONS-580?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013329#comment-15013329 ] Stevie Beck commented on COLLECTIONS-580: - This reminds me of the the general "SerialDoS"

[jira] [Comment Edited] (MATH-1293) Tabulating the logarithmic factorial

2015-11-19 Thread Aleksei Dievskii (JIRA)
[ https://issues.apache.org/jira/browse/MATH-1293?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013226#comment-15013226 ] Aleksei Dievskii edited comment on MATH-1293 at 11/19/15 10:18 AM: --- At

[GitHub] commons-lang pull request: LANG-1186 Fix NullPointerException in F...

2015-11-19 Thread NickManley
GitHub user NickManley opened a pull request: https://github.com/apache/commons-lang/pull/117 LANG-1186 Fix NullPointerException in FastDateParser$TimeZoneStrategy Java 8u60 has a change where `DateFormatSymbols.getZoneStrings` returns arrays with 7 elements instead of 5 like it

[jira] [Created] (LANG-1186) NullPointerException in FastDateParser$TimeZoneStrategy

2015-11-19 Thread Nick Manley (JIRA)
Nick Manley created LANG-1186: - Summary: NullPointerException in FastDateParser$TimeZoneStrategy Key: LANG-1186 URL: https://issues.apache.org/jira/browse/LANG-1186 Project: Commons Lang Issue

[jira] [Commented] (LANG-1186) NullPointerException in FastDateParser$TimeZoneStrategy

2015-11-19 Thread ASF GitHub Bot (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1186?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15015251#comment-15015251 ] ASF GitHub Bot commented on LANG-1186: -- GitHub user NickManley opened a pull request:

[jira] [Commented] (LANG-1186) NullPointerException in FastDateParser$TimeZoneStrategy

2015-11-19 Thread Nick Manley (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1186?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15015252#comment-15015252 ] Nick Manley commented on LANG-1186: --- Created a pull request:

[jira] [Issue Comment Deleted] (LANG-1186) NullPointerException in FastDateParser$TimeZoneStrategy

2015-11-19 Thread Nick Manley (JIRA)
[ https://issues.apache.org/jira/browse/LANG-1186?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Nick Manley updated LANG-1186: -- Comment: was deleted (was: Created a pull request: https://github.com/apache/commons-lang/pull/117) >

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Adrian Crum (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013889#comment-15013889 ] Adrian Crum commented on IO-487: Without the class name, the exception is not useful to the developer. What

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013920#comment-15013920 ] Bertrand Delacretaz commented on IO-487: I have committed IO-487-accept-reject-2.patch with minor

[jira] [Comment Edited] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013920#comment-15013920 ] Bertrand Delacretaz edited comment on IO-487 at 11/19/15 5:11 PM: -- I have

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013951#comment-15013951 ] Bertrand Delacretaz commented on IO-487: bq. If I try to exploit code by desrializing MyExploit.class,

[jira] [Commented] (IO-487) ValidatingObjectInputStream contribution - restrict which classes can be deserialized

2015-11-19 Thread Bertrand Delacretaz (JIRA)
[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013966#comment-15013966 ] Bertrand Delacretaz commented on IO-487: Added the class name in the InvalidClassException, as