[OGNL-182] Class.forName() usage is malicious inside OSGi

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 4.0
• Assignee: Simone Tripodi
• Reporter: Simone Tripodi
• Created: 24/Sep/11 21:44
• Updated: 27/Mar/13 12:37
• Resolved: 23/Oct/11 11:33

Description

Class.forName() could make OGNL unusable inside OSGi.
The fix would involve the ClassLoader.loadClass() method, allowing users setting a custom {{ClassLoader}

Classes affected by that issues are:

• org.apache.commons.ognl.DefaultClassResolver
• org.apache.commons.ognl.OgnlRuntime

The org.apache.commons.ognl.ASTMap class is affected as well, even if loading java.util.LinkedHashMap in that way should be safe.