update to 0.3.2 of delight-nashorn-sandbox

javadelight / delight-graaljs-sandbox

A sandbox for executing JavaScript with Graal in Java

Other

44 stars 11 forks source link

Closed untra closed 1 year ago

untra commented 1 year ago

updates delight-nashorn-sandbox to latest 0.3.2 to address transitive reDOS vulnerability in to fix transitive CVE-2021-40660 (see: https://devhub.checkmarx.com/cve-details/CVE-2021-40660/)

untra commented 1 year ago

not sure if this PR builds correctly or if there are other breaking changes, just want to keep the fixes rolling

mxro commented 1 year ago

Thank you for the pull request!

mxro commented 1 year ago

Almost got everything working, just need to ensure Nashorn sandbox is compatible with Java 20. https://github.com/javadelight/delight-nashorn-sandbox/tree/change-to-recent-java-version - errors out on Thread.stop() which now leads to an exception.