Re: [Full-disclosure] [SE-2012-01] New Reflection API affected by a known 10+ years old attack

[Jeffrey Walton <noloader@xxxxxxxxx>]

On Thu, Jul 18, 2013 at 12:50 AM, Security Explorations
<contact@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> Hello All,
>
> We discovered yet another indication that new Reflection API introduced
> into Java SE 7 was not a subject to a thorough security review (if any).
I'm kind or surpised some of these bugs exist for so long. Allowing
them to fester and rot can't be good (I have not been able to come up
with a use case where it is desired or preferred).

Does anyone know anything about Oracle's engineering process? What is
Oracle doing to ensure issues are tracked and remediated in reasonable
time? What does the process include for code scanning to catch low
hanging fruit? Are they using Find Bugs or Coverity (I checked
scan.coverity.com, and I did not see Oracle Java or OpenJDK listed, so
I wonder if they are doing it internally). What is the QA process
doing to ensure items with negative impact are not allowed to pass?

Jeff