CVE-2022-22968
This problem was first identified in the Spring Data project, where it was discovered that the actual case of the field name was being ignored. As a result, DataBinder implementations which do not enforce the case of the field names in the DataBinder would allow setting any of the fields in the DataBinder with any of the other fields. There are two common workarounds for this problem. The first is to always use the exact case for all field names, as described above. The second workaround is to use a custom DataBinder which uses a regular expression to check the case of the field name. For example, if we wanted to use the custom DataBinder with the field names "First Name" and "Last Name" we could use the regular expression: ^firstName$ To use this custom DataBinder, you must upgrade to Spring Framework version 5.3.19 or newer, as 5.3.19 or newer is the first version which supports the new version of DataBinder.
CVE-2022-22969
The second problem is a change in behaviour in Spring Data REST to allow "self referencing" methods. This allowed the following code to be executed without any type or message:
{"id":"foo","name":"bar"}.findByName("baz")
The issue here is that the string "baz" does not exist anywhere in the rest controller (only "bar" exists), so the method will execute with no message and no exception thrown. This can be fixed by adding a type constraint to either the method or the parameter being passed into it, as shown below:
public Object findByName(String name) { // return some value } public Object findByName(String name, Object... params) { // return some value } public Object findByName(String name, Class
NullPointerException in JMS Message
One of the most common problems in Java messaging is when a null reference exception is raised. The Spring Framework provides many tools to help you address this problem, such as the @NotNull annotation, and the @Nullable annotation. However, these annotations are not sufficient in all cases. For example, if you're using JMS and want to send a message to an endpoint that doesn't exist, it's possible that your application will throw a NullPointerException when trying to send the message.
Timeline
Published on: 04/14/2022 21:15:00 UTC
Last modified on: 07/25/2022 18:20:00 UTC