5 ms·
Are you deliberately spamming this board with FUD ? spring-beans and spring-core are the fundamental building blocks of most Java EE applications and using t
by manishsharan 14y ago
Are you deliberately spamming this board with FUD ?
spring-beans and spring-core are the fundamental building blocks of most Java EE applications and using them in no way causes the aforementioned vulnerability.
The only case that causes this vulnerability is when a JSP page contains this code :
<spring:message text="" code="${param['message']}"></spring:message>
Any admin can run fgrep or equivalent on all jsps to see if they contain this text
<spring:message text="" code="${param
- Anderkent 14y agoparam is not really part of the bug - if I understand correctly, any argument passed to the these tags will be evaluated twice. So you have to check for message/theme/bind/nestedpath/transform tags and ensure no user-influenced data is fed to it. And if you use a templating engine that uses these tags you'd have to trace whether they are invoked anywhere... So it's not as simple as a grep at all.