[GitHub] [commons-jxpath] ecki commented on pull request #26: Add an allow list for classes that can be loaded by JXPath

["ecki (via GitHub)" <gi...@apache.org>]

ecki commented on PR #26:
URL: https://github.com/apache/commons-jxpath/pull/26#issuecomment-1474461889

   I don’t think „most“ is correct, since this was not much requested before and many users probably only issue static jxpath expressions or use it as a cheap java eval language anyway.
   
   having said that, your mentioning of the FunctionLibrary is on point, and it also looks like a better way to filter. Jxpath can just ship (configurable) alternatives, which especially have allow lists for functions, can turn java evaluation off or restrict classes and methods (similar to like the PR does, ideally without the need to allow internal methods)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org