You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@commons.apache.org by "zhouyanming (JIRA)" <ji...@apache.org> on 2013/07/22 05:34:50 UTC

[jira] [Created] (OGNL-237) disable construct object using new for security

zhouyanming created OGNL-237:
--------------------------------

             Summary: disable construct object using new for security
                 Key: OGNL-237
                 URL: https://issues.apache.org/jira/browse/OGNL-237
             Project: Commons OGNL
          Issue Type: Improvement
            Reporter: zhouyanming
            Priority: Critical


struts2 is suffering security vulnerability caused by ognl
I don't know who would like to new objects in expression,if it must be left for compatibility,please build a blacklist for java.xxx and javax.xxx

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira