CVE-2022-33980 The Apache Commons Configuration module performs variable interpolation, expanding properties.

CVE-2022-33980 The Apache Commons Configuration module performs variable interpolation, expanding properties.

or a later version. Apache Commons Configuration supports interpolation of various data types, such as date and number formats. The format for interpolation of date and number formats may be specified using the ${format} syntax. By default, Apache Commons Configuration uses the org.apache.commons.configuration2.interpol.DateInterpolator for date interpolation and the org.apache.commons.configuration2.interpol.NumberInterpolator for number interpolation. These interpolators may be changed or replaced with alternative implementations in custom interpolators. Apache Commons Configuration 2.8 and later support custom interpolators that may be specified using the --interpolator command-line option. In addition to the default interpolators, there are a few other interpolators available for use: - org.apache.commons.configuration2.interpol.NullInterpolator - nullifies the value - org.apache.commons.configuration2.interpol.ArrayInterpolator - expands to an array of the given type - org.apache.commons.configuration2.interpol.ObjectInterpolator - expands to an object of the given type If a new data type needs to be interpolated, it must be wrapped in an implementation of the org.apache.commons.configuration2.interpol.DataInterpolator interface.

Supported Data Types

The following are the supported data types:
- Boolean - Boolean value that is either true or false
- Integer - Integer value that is an integer between 0 and infinity
- Long - Long value that is a long integer
- Float - Float value that is a floating point number with decimal precision

Configuring interpolators

The default interpolators can be configured by passing a string to the --interpolator command-line option. The string may contain any of the following:
- "date" - expands to an instance of org.apache.commons.configuration2.interpol.DateInterpolator
- "number" - expands to an instance of org.apache.commons.configuration2.interpol.NumberInterpolator
- "null" - expands to null
- "array" - expands to an array containing the given type

Installing and Using Apache Commons Configuration

If the --interpolator option is not specified, Apache Commons Configuration uses the default interpolators to interpolate values. To install Apache Commons Configuration, use a standard Maven method:

API Overview

Apache Commons Configuration has two types of data interpolators: the default org.apache.commons.configuration2.interpol.DateInterpolator and the default org.apache.commons.configuration2.interpol.NumberInterpolator, which may be replaced with custom implementations in custom interpolators specified via --interpolator command-line option (org.apache.commons.configuration2.interpol). The following table describes the function of each type of interpolator:

- DateInterpolator - Returns a date from the value to be interpolated - NumberInterpolator - Returns a number from the value to be interpolated
- NullInterpolator - nullifies the value

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe