pool/velocity
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OBS-URL: https://build.opensuse.org/package/show/Java:packages/velocity?expand=0&rev=39

Browse Source
This commit is contained in:
Fridrich Strba 2021-03-12 15:58:47 +00:00 committed by Git OBS Bridge
parent 63a3cae7f0
commit 81646c172a
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
velocity-1.7-CVE-2020-13936.patch
View File

@ -1,5 +1,5 @@
--- velocity-1.7/src/java/org/apache/velocity/runtime/defaults/velocity.properties 2010-11-19 21:16:27.000000000 +0100
+++ velocity-1.7/src/java/org/apache/velocity/runtime/defaults/velocity.properties 2021-03-12 09:12:50.474890036 +0100
--- a/src/java/org/apache/velocity/runtime/defaults/velocity.properties
+++ b/src/java/org/apache/velocity/runtime/defaults/velocity.properties
@@ -245,15 +245,15 @@
# accessed.
# ----------------------------------------------------------------------------
@ -38,8 +38,8 @@
+
+
--- velocity-1.7/src/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java 2010-11-19 21:16:28.000000000 +0100
+++ velocity-1.7/src/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java 2021-03-12 09:08:35.169371137 +0100
--- a/src/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
+++ b/src/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
@@ -122,6 +122,15 @@
}
@ -49,7 +49,7 @@
+ if (ClassLoader.class.isAssignableFrom(clazz) ||
+ Thread.class.isAssignableFrom(clazz))
+ {
+ return false;
+ return false;
+ }
+
+ /**