You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@jackrabbit.apache.org by "Manfred Baedke (Jira)" <ji...@apache.org> on 2025/04/08 13:03:00 UTC

[jira] [Resolved] (JCR-5135) Make JNDI support opt-in

     [ https://issues.apache.org/jira/browse/JCR-5135?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Manfred Baedke resolved JCR-5135.
---------------------------------
    Resolution: Fixed

> Make JNDI support opt-in
> ------------------------
>
>                 Key: JCR-5135
>                 URL: https://issues.apache.org/jira/browse/JCR-5135
>             Project: Jackrabbit Content Repository
>          Issue Type: Task
>          Components: jackrabbit-jcr-commons
>            Reporter: Julian Reschke
>            Assignee: Manfred Baedke
>            Priority: Major
>              Labels: candidate_jackrabbit_2.22
>             Fix For: 2.24, 2.23.2
>
>
> Support for JNDI is inherently dangerous, because it can load classes from another location. Users of the method might not be aware when using it and just pass parameter values without
> sanitization. It would probably also be good to add a warning to the method and state that parameters should come from configuration and not passed in from an end user.
> (ack [~mreutegg] )



--
This message was sent by Atlassian Jira
(v8.20.10#820010)