4 ms·
The security advisory from Atlassian says blocking ${ "may reduce your risk". That's a far cry from being a fix.
by justin_oaks 4y ago
The security advisory from Atlassian says blocking ${ "may reduce your risk". That's a far cry from being a fix.
- technion 4y agoI really worry about these sort of claims. I'm seeing pushback from people about shutting servers down because it's insisted "a WAF is protecting us now", and that's based on a "may reduce risk".
- richbell 4y agoSame issue with log4shell. "Why are you bugging us? We already applied <mitigation posted 2 weeks ago that has since been disproven>."
- tyingq 4y agoI would worry about just using that blocking pattern. They mention OGNL injection and ${ is just one pattern you can go after. There's also #{, %{, #var, and more.