You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@commons.apache.org by GitBox <gi...@apache.org> on 2022/11/03 15:08:29 UTC

[GitHub] [commons-jxpath] ecki commented on pull request #26: Fix CVE-2022-41852

ecki commented on PR #26:
URL: https://github.com/apache/commons-jxpath/pull/26#issuecomment-1302255250

   We should clarify if the Whitelist on classes includes inherited methods. 
   
   Be careful with default Whitelist, String.wait() and .class/.getClass() (or generally all methods inherited from object?) should probably not be included. Similar Integer/Boolean.getProperty


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org