{"action":"created","issue":{"url":"https://api.github.com/repos/spring-guides/gs-uploading-files/issues/26","repository_url":"https://api.github.com/repos/spring-guides/gs-uploading-files","labels_url":"https://api.github.com/repos/spring-guides/gs-uploading-files/issues/26/labels{/name}","comments_url":"https://api.github.com/repos/spring-guides/gs-uploading-files/issues/26/comments","events_url":"https://api.github.com/repos/spring-guides/gs-uploading-files/issues/26/events","html_url":"https://github.com/spring-guides/gs-uploading-files/pull/26","id":163998038,"number":26,"title":"Fix Security Issue","user":{"login":"xenoterracide","id":5517,"avatar_url":"https://avatars.githubusercontent.com/u/5517?v=3","gravatar_id":"","url":"https://api.github.com/users/xenoterracide","html_url":"https://github.com/xenoterracide","followers_url":"https://api.github.com/users/xenoterracide/followers","following_url":"https://api.github.com/users/xenoterracide/following{/other_user}","gists_url":"https://api.github.com/users/xenoterracide/gists{/gist_id}","starred_url":"https://api.github.com/users/xenoterracide/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xenoterracide/subscriptions","organizations_url":"https://api.github.com/users/xenoterracide/orgs","repos_url":"https://api.github.com/users/xenoterracide/repos","events_url":"https://api.github.com/users/xenoterracide/events{/privacy}","received_events_url":"https://api.github.com/users/xenoterracide/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-07-06T04:53:56Z","updated_at":"2016-07-06T23:35:26Z","closed_at":"2016-07-06T23:35:16Z","pull_request":{"url":"https://api.github.com/repos/spring-guides/gs-uploading-files/pulls/26","html_url":"https://github.com/spring-guides/gs-uploading-files/pull/26","diff_url":"https://github.com/spring-guides/gs-uploading-files/pull/26.diff","patch_url":"https://github.com/spring-guides/gs-uploading-files/pull/26.patch"},"body":"The short is that if somehow there were a malicious class on the classpath having the field be public and static would allow any class to change it. It would be better if the tutorial didn't use this. I don't actually think the constant needs to be public.\r\n\r\nfrom findbugs\r\n\r\n>\r\nReturning a reference to a mutable object value stored in one of the object's fields exposes the internal representation of the object.  If instances are accessed by untrusted code, and unchecked changes to the mutable object would compromise security or other important properties, you will need to do something different. Returning a new copy of the object is better approach in many situations."},"comment":{"url":"https://api.github.com/repos/spring-guides/gs-uploading-files/issues/comments/230939041","html_url":"https://github.com/spring-guides/gs-uploading-files/pull/26#issuecomment-230939041","issue_url":"https://api.github.com/repos/spring-guides/gs-uploading-files/issues/26","id":230939041,"user":{"login":"gregturn","id":311040,"avatar_url":"https://avatars.githubusercontent.com/u/311040?v=3","gravatar_id":"","url":"https://api.github.com/users/gregturn","html_url":"https://github.com/gregturn","followers_url":"https://api.github.com/users/gregturn/followers","following_url":"https://api.github.com/users/gregturn/following{/other_user}","gists_url":"https://api.github.com/users/gregturn/gists{/gist_id}","starred_url":"https://api.github.com/users/gregturn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gregturn/subscriptions","organizations_url":"https://api.github.com/users/gregturn/orgs","repos_url":"https://api.github.com/users/gregturn/repos","events_url":"https://api.github.com/users/gregturn/events{/privacy}","received_events_url":"https://api.github.com/users/gregturn/received_events","type":"User","site_admin":false},"created_at":"2016-07-06T23:35:26Z","updated_at":"2016-07-06T23:35:26Z","body":"Thanks for your patch to make the value final. It does need to be visible to both classes. This could arguably be made package private, but not critical for the guide."}}
{"actor":{"display_login":"gregturn"}}