You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@activemq.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2021/08/06 05:20:00 UTC
[jira] [Commented] (AMQ-8348) XmlMessageRenderer has the risk of
XStream deserialization
[ https://issues.apache.org/jira/browse/AMQ-8348?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17394524#comment-17394524 ]
ASF subversion and git services commented on AMQ-8348:
------------------------------------------------------
Commit 4fd439e91d5b00406714c886f1d520780e6f0aff in activemq's branch refs/heads/main from Jean-Baptiste Onofré
[ https://gitbox.apache.org/repos/asf?p=activemq.git;h=4fd439e ]
Merge pull request #697 from skyguard1/fix_xstream_xml_risk
[AMQ-8348] Fix XmlMessageRenderer has the risk of XStream deserialization
> XmlMessageRenderer has the risk of XStream deserialization
> ----------------------------------------------------------
>
> Key: AMQ-8348
> URL: https://issues.apache.org/jira/browse/AMQ-8348
> Project: ActiveMQ
> Issue Type: Improvement
> Components: Transport
> Reporter: Zixuan Liu
> Assignee: Jean-Baptiste Onofré
> Priority: Minor
> Fix For: 5.17.0, 5.16.3
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> XmlMessageRenderer.getXstream() method:
> {code:java}
> public XStream getXstream() {
> if (xstream == null) {
> xstream = new XStream();
> }
> return xstream;
> }{code}
> There is a risk of XStream deserialization
--
This message was sent by Atlassian Jira
(v8.3.4#803005)