{"action":"created","issue":{"url":"https://api.github.com/repos/frohoff/ysoserial/issues/47","repository_url":"https://api.github.com/repos/frohoff/ysoserial","labels_url":"https://api.github.com/repos/frohoff/ysoserial/issues/47/labels{/name}","comments_url":"https://api.github.com/repos/frohoff/ysoserial/issues/47/comments","events_url":"https://api.github.com/repos/frohoff/ysoserial/issues/47/events","html_url":"https://github.com/frohoff/ysoserial/pull/47","id":156104831,"number":47,"title":"Dynamic loader #10","user":{"login":"drosenbauer","id":3833208,"avatar_url":"https://avatars.githubusercontent.com/u/3833208?v=3","gravatar_id":"","url":"https://api.github.com/users/drosenbauer","html_url":"https://github.com/drosenbauer","followers_url":"https://api.github.com/users/drosenbauer/followers","following_url":"https://api.github.com/users/drosenbauer/following{/other_user}","gists_url":"https://api.github.com/users/drosenbauer/gists{/gist_id}","starred_url":"https://api.github.com/users/drosenbauer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drosenbauer/subscriptions","organizations_url":"https://api.github.com/users/drosenbauer/orgs","repos_url":"https://api.github.com/users/drosenbauer/repos","events_url":"https://api.github.com/users/drosenbauer/events{/privacy}","received_events_url":"https://api.github.com/users/drosenbauer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-21T14:33:00Z","updated_at":"2016-05-25T15:43:12Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/frohoff/ysoserial/pulls/47","html_url":"https://github.com/frohoff/ysoserial/pull/47","diff_url":"https://github.com/frohoff/ysoserial/pull/47.diff","patch_url":"https://github.com/frohoff/ysoserial/pull/47.patch"},"body":"Includes changes for #23, so all changes over in PR #45 are included. This branch also includes:\r\n\r\n1. A dynamic classloader `IsolatingGroovyClassLoader` that will pull items down from Groovy's Grape repository at runtime. This also sets things up to support Groovy payload generators in the future.\r\n2. A new annotation, `@DynamicDependencies`, which supports complex expression-based dependency resolution, rather than the `DynamicDependencies` interface. This allows us to skip initializing the class before loading dependencies. GroovyShell is used to resolve expressions. Command line arguments are supported with the `arg` binding.\r\n3. Tests for most payloads have been updated to use the dynamic classloader. The `MyFaces` tests are skipped.\r\n \r\nSince there were lots of issues merging, if this is fine, I'll revoke PR #45. I'd rather do this all at once so I can stop working in these branches. :) "},"comment":{"url":"https://api.github.com/repos/frohoff/ysoserial/issues/comments/221617269","html_url":"https://github.com/frohoff/ysoserial/pull/47#issuecomment-221617269","issue_url":"https://api.github.com/repos/frohoff/ysoserial/issues/47","id":221617269,"user":{"login":"drosenbauer","id":3833208,"avatar_url":"https://avatars.githubusercontent.com/u/3833208?v=3","gravatar_id":"","url":"https://api.github.com/users/drosenbauer","html_url":"https://github.com/drosenbauer","followers_url":"https://api.github.com/users/drosenbauer/followers","following_url":"https://api.github.com/users/drosenbauer/following{/other_user}","gists_url":"https://api.github.com/users/drosenbauer/gists{/gist_id}","starred_url":"https://api.github.com/users/drosenbauer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drosenbauer/subscriptions","organizations_url":"https://api.github.com/users/drosenbauer/orgs","repos_url":"https://api.github.com/users/drosenbauer/repos","events_url":"https://api.github.com/users/drosenbauer/events{/privacy}","received_events_url":"https://api.github.com/users/drosenbauer/received_events","type":"User","site_admin":false},"created_at":"2016-05-25T15:43:12Z","updated_at":"2016-05-25T15:43:12Z","body":"I believe I've stabilized this build. I am not using the Groovy Grape.grab anymore, because it seemed to have some timeout issues via Ivy. There's an open Ivy issue to set the timeout, but it currently doesn't support it. If the JAR was partially downloaded from Maven Central when the timeout occurred, it would never run in the future. I switched to the same JBoss library used by @mbechler in the test harness, although using Aether directly is probably a better idea still. That can be a future change.\r\n\r\nThe POM now has all JARs set as \"provided\" apart from those needed for exploits. All payloads will dynamically load their dependencies."}}
{"actor":{"display_login":"drosenbauer"}}