Add an allow list for classes that can be loaded by JXPath - #26

Open

kyakdan wants to merge 14 commits into

apache:masterfrom

CodeIntelligenceTesting:master

Commits on Oct 19, 2022

Fix CVE-2022-41852

bharathmohanraj
authored and
kyakdan
committed
7701da7
Throw JXPathException directly when filtering a function class
kyakdan
committed
02dc4f5
Enable the allow-list by default for all getFunction methods
kyakdan
committed
c248c0b
Update JXPathClassFilter documentation to mention the allow-all option
kyakdan
committed
6d5e13f
Organize Imports
kyakdan
committed
0e337f0
Convert the restricted classes into a Set
kyakdan
committed
b306289
Fix Checkstyle and PMD errors
kyakdan
committed
ff5ab0a
Minor refactoring and clean-up
kyakdan
committed
021b8ce

Commits on Oct 20, 2022

Use JXPathFilter based on the `jxpath.allow.class` system property
kyakdan
committed
27d1ec0

Commits on Oct 21, 2022

Refactor the JXPathFilter
kyakdan
committed
abb96a5
Add filtering to the MethodFunction class
kyakdan
committed
36bc1b2

Commits on Oct 25, 2022

Fix tests
kyakdan
committed
b0e0000
Make JXPathFilter accessible/configurable on the context level
kyakdan
committed
85620c6
Add a CustomJXPathFilter class for programmatically configurable filter
kyakdan
committed
c9e1b30