From 8a25e5bb2a6446bdf43861dde55bfd6d4b973511 Mon Sep 17 00:00:00 2001 From: Brian Clozel Date: Thu, 31 Mar 2022 09:34:51 +0200 Subject: [PATCH] Refine PropertyDescriptor filtering Restrict property paths under `Class` and properties of types `ClassLoader` or `ProtectionDomain`. --- .../beans/CachedIntrospectionResults.java | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java b/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java index e7926fd723b2..b9b0778a685b 100644 --- a/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java +++ b/spring-beans/src/main/java/org/springframework/beans/CachedIntrospectionResults.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2014 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -20,6 +20,7 @@ import java.beans.IntrospectionException; import java.beans.Introspector; import java.beans.PropertyDescriptor; +import java.security.ProtectionDomain; import java.util.Collections; import java.util.Iterator; import java.util.LinkedHashMap; @@ -288,9 +289,13 @@ private CachedIntrospectionResults(Class beanClass) throws BeansException { // This call is slow so we do it once. PropertyDescriptor[] pds = this.beanInfo.getPropertyDescriptors(); for (PropertyDescriptor pd : pds) { - if (Class.class.equals(beanClass) && - ("classLoader".equals(pd.getName()) || "protectionDomain".equals(pd.getName()))) { - // Ignore Class.getClassLoader() and getProtectionDomain() methods - nobody needs to bind to those + if (Class.class == beanClass && (!"name".equals(pd.getName()) && !pd.getName().endsWith("Name"))) { + // Only allow all name variants of Class properties + continue; + } + if (pd.getPropertyType() != null && (ClassLoader.class.isAssignableFrom(pd.getPropertyType()) + || ProtectionDomain.class.isAssignableFrom(pd.getPropertyType()))) { + // Ignore ClassLoader and ProtectionDomain types - nobody needs to bind to those continue; } if (logger.isTraceEnabled()) { @@ -300,6 +305,11 @@ private CachedIntrospectionResults(Class beanClass) throws BeansException { "; editor [" + pd.getPropertyEditorClass().getName() + "]" : "")); } pd = buildGenericTypeAwarePropertyDescriptor(beanClass, pd); + if (pd.getPropertyType() != null && (ClassLoader.class.isAssignableFrom(pd.getPropertyType()) + || ProtectionDomain.class.isAssignableFrom(pd.getPropertyType()))) { + // Ignore ClassLoader and ProtectionDomain types - nobody needs to bind to those + continue; + } this.propertyDescriptorCache.put(pd.getName(), pd); }