2 ms·

The fix still loads the class before checking if it’s okay. That’s a smaller attack window but it’s still not zero.

• josefx 2y ago
  Java reflection can load classes without initializing them, so no untrusted code would have to be executed at that point.
  • hinkley 2y ago
    I haven’t been in Java for a good while. When did they do that? Static initializers used to load on Classloader calls.
    • josefx 2y ago
      An overload for Class.forName with an explicit initialize parameter was added in Java 1.2 .
      • hinkley 2y ago
        Except they don't call Class.forName(..., false, ...) anywhere in the codebase, so my original comment still stands.