You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@jackrabbit.apache.org by "Konrad Windszus (Jira)" <ji...@apache.org> on 2026/10/20 09:49:00 UTC

[jira] [Updated] (JCRVLT-862) Restrict "config.xml" includes/excludes to ItemFilter's only

     [ https://issues.apache.org/jira/browse/JCRVLT-862?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Konrad Windszus updated JCRVLT-862:
-----------------------------------
    Security:     (was: Private)

> Restrict "config.xml" includes/excludes to ItemFilter's only
> ------------------------------------------------------------
>
>                 Key: JCRVLT-862
>                 URL: https://issues.apache.org/jira/browse/JCRVLT-862
>             Project: Jackrabbit FileVault
>          Issue Type: Bug
>            Reporter: Konrad Windszus
>            Assignee: Konrad Windszus
>            Priority: Major
>             Fix For: 4.3.0
>
>
> Package configuration files (config.xml) can name any Java class, and the software loads that class as soon as a package is opened, before permissions are checked. A crafted package could abuse this to run code on the server. The fix allows only approved filter types and blocks a syntax that reads class values directly. Built-in configurations don't use these features, so nothing shipped should break.
> https://github.com/apache/jackrabbit-filevault-private/issues/5



--
This message was sent by Atlassian Jira
(v8.20.10#820010)