|
2 | 2 |
|
3 | 3 |
|
4 | 4 | <!-- |
5 | | - | Generated by Apache Maven Doxia Site Renderer 2.0.0 from src/site/xhtml/20-getting-started.xhtml at 2026-01-09 |
| 5 | + | Generated by Apache Maven Doxia Site Renderer 2.0.0 from src/site/xhtml/20-getting-started.xhtml at 2026-08-16 |
6 | 6 | | Rendered using Apache Maven Fluido Skin 2.1.0 |
7 | 7 | --> |
8 | 8 | <html xmlns="http://www.w3.org/1999/xhtml" lang="en"> |
|
27 | 27 |
|
28 | 28 | <div id="breadcrumbs"> |
29 | 29 | <ul class="breadcrumb"> |
30 | | - <li id="projectVersion">Version: 5.1.6-SNAPSHOT</li> |
31 | | - <li id="publishDate" class="pull-right"><span class="divider">|</span> Last Published: 2026-01-09</li> |
| 30 | + <li id="projectVersion">Version: 5.1.7-SNAPSHOT</li> |
| 31 | + <li id="publishDate" class="pull-right"><span class="divider">|</span> Last Published: 2026-08-16</li> |
32 | 32 | <li class="pull-right"><span class="divider">|</span> |
33 | 33 | <a href="https://ucanaccess.sourceforge.net/" target="_blank">Legacy project (SourceForge)</a></li> |
34 | 34 | <li class="pull-right"><span class="divider">|</span> |
@@ -88,7 +88,7 @@ <h2>Adding UCanAccess to your Java project</h2> |
88 | 88 | <dependency> |
89 | 89 | <groupId>io.github.spannm</groupId> |
90 | 90 | <artifactId>ucanaccess</artifactId> |
91 | | - <version>5.1.3</version> |
| 91 | + <version>5.1.7</version> |
92 | 92 | </dependency></pre> |
93 | 93 |
|
94 | 94 | </section><section><a id="Establishing_a_UCanAccess_connection"></a> |
@@ -270,6 +270,16 @@ <h2>Connection Properties</h2> |
270 | 270 | dependencies</strong><br /> |
271 | 271 | </p> |
272 | 272 |
|
| 273 | +<p> |
| 274 | + <strong>Security note:</strong> the class name passed to <code>jackcessOpener</code> is loaded and |
| 275 | + instantiated via reflection using its public no-arg constructor. This parameter must therefore only ever |
| 276 | + be set from trusted, static application configuration – never from untrusted or user-supplied input |
| 277 | + (e.g. values taken from an HTTP request, or forwarded unchecked from an external system). Populating |
| 278 | + <code>jackcessOpener</code> from untrusted input could allow an attacker to trigger the construction of |
| 279 | + an arbitrary class implementing <i>IJackcessOpenerInterface</i> that is reachable on the application's |
| 280 | + classpath. |
| 281 | + </p> |
| 282 | + |
273 | 283 | <pre> |
274 | 284 | package yourPackage.example; |
275 | 285 |
|
|
0 commit comments