Commons – Apache Commons BeanUtils (original) (raw)

Most Java developers are used to creating Java classes that conform to the JavaBeans naming patterns for property getters and setters. It is natural to then access these methods directly, using calls to the correspondinggetXxx and setXxx methods. However, there are some occasions where dynamic access to Java object properties (without compiled-in knowledge of the property getter and setter methods to be called) is needed. Example use cases include:

The Java language provides Reflection and _Introspection_APIs (see the java.lang.reflect and java.beanspackages in the JDK Javadocs). However, these APIs can be quite complex to understand and utilize. The BeanUtils component provides easy-to-use wrappers around these capabilities.

BeanUtils Core And Modules

The 1.7.x and 1.8.x releases of BeanUtils distributed three jars:

The main commons-beanutils.jar has an optional dependency onCommons Collections

Version 1.9.0 reverts this split for reasons outlined atBEANUTILS-379. There is now only one jar for the BeanUtils library.

Version 2.0.0 updates the dependencies for Apache Commons Collection from version 3 to 4. Apache Commons Collection 4 changes packages from org.apache.commons.collectionsto org.apache.commons.collections4. Since some Commons BeanUtils APIs surface Commons Collection types, Commons BeanUtils 2 changes packages from org.apache.commons.beanutilsto org.apache.commons.beanutils2.

Bean Collections

Bean collections is a library combining BeanUtils with Commons Collectionsto provide services for collections of beans. One class (BeanComparator) was previously released, the rest are new. This new distribution strategy should allow this sub-component to evolve naturally without the concerns about size and scope that might otherwise happen.

Bean Collections has an additional dependency on Commons Collections.

Releases

2.0.x releases

BeanUtils 2.0.x releases are not binary compatible (but easy to port) with version 1.x.x and require a minimum of Java 8.

The latest BeanUtils release is available to downloadhere.

1.9.x releases

The latest BeanUtils release is available to downloadhere.
1.9.4

CVE-2019-10086. Apache Commons Beanutils does not suppresses the class property in bean introspection by default.

Severity. Medium

Vendor. The Apache Software Foundation

Versions Affected. All versions commons-beanutils-1.9.3 and before.

Description. In version 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Mitigation. Upgrade to commons-beanutils-1.9.4

Credit. This was discovered by Melloware (https://melloware.com/).

Example.

/**
* Example usage after 1.9.4
*/
public void testSuppressClassPropertyByDefault() throws Exception {
  final BeanUtilsBean bub = new BeanUtilsBean();
  final AlphaBean bean = new AlphaBean();
  try {
    bub.getProperty(bean, "class");
    fail("Could access class property!");
  } catch (final NoSuchMethodException ex) {
    // ok
  }
}

/**
* Example usage to restore 1.9.3 behavior
*/
public void testAllowAccessToClassProperty() throws Exception {
  final BeanUtilsBean bub = new BeanUtilsBean();
  bub.getPropertyUtils().removeBeanIntrospector(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);
  final AlphaBean bean = new AlphaBean();
  String result = bub.getProperty(bean, "class");
  assertEquals("Class property should have been accessed", "class org.apache.commons.beanutils2.AlphaBean", result);
}

BeanUtils 1.9.x releases are binary compatible (with a minor exception described in the release notes) with version 1.8.3 and require a minimum of JDK 1.5.

The latest BeanUtils release is available to downloadhere.

1.8.x releases

BeanUtils 1.8.x releases are binary compatible with version 1.7.0 and require a minimum of JDK 1.3.

1.7.0

BeanUtils 1.7.0 is a service release which removes the dependency upon a specific commons-collection library version. It may be safely used together with either the 2.x or 3.x series of commons-collections releases. It also introduces a number of important enhancements. It is backward compatible with the 1.6 release.

This important service release is intended to help downstream applications solve dependency issues. The dependency on commons collections (which has become problematic now that there are two incompatible series of commons collections releases) has been factored into a separate optional sub-component plus a small number of stable and mature org.apache.commons.collections packaged classes (which are distributed with the BeanUtils core). This arrangement means that the BeanUtils core sub-component (which is the primary dependency for most downsteam applications) can now be safely included on the same classpath as commons collections 2.x, 3.x or indeed neither.

The distribution now contains alternative jar sets. The all-in-one jar contains all classes. The modular jar set consists of a core jar dependent only on commons logging and an optional bean collections jar (containing classes that provide easy and efficient ways to manage collections of beans) which depends on commons collections 3.

Older Releases (Not Mirrored)

Support

The commons mailing lists act as the main support forum. The user list is suitable for most library usage queries. The dev list is intended for the development discussion. Please remember that the lists are shared between all commons components, so prefix your email by [beanutils].

Issues may be reported via ASF JIRA.