Skip to content

Pull requests: COG-GTM/BroadleafCommerce

New pull request New
117 Open 0 Closed
117 Open 0 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Filtering classes during Zookeeper distributed queue deserialization (CWE-502)
#117 opened Sep 14, 2026 by Colhodm Loading…
@Colhodm
1
bug: restrict Java deserialization in ZookeeperDistributedQueue (CWE-502)
#116 opened Sep 10, 2026 by Colhodm Loading…
@Colhodm
1
Restricting ZookeeperDistributedQueue deserialization to an allowlist (CWE-502)
#115 opened Sep 9, 2026 by Colhodm Loading…
@Colhodm
1
Adding ObjectInputFilter allowlist to ZookeeperDistributedQueue deserialization (CWE-502)
#114 opened Sep 7, 2026 by Colhodm Loading…
@Colhodm
1
Restrict Java deserialization in ZookeeperDistributedQueue (CWE-502)
#113 opened Sep 3, 2026 by Colhodm Loading…
@Colhodm
1
Restrict class deserialization in ZookeeperDistributedQueue (CWE-502)
#112 opened Sep 2, 2026 by Colhodm Loading…
@Colhodm
1
Restricting classes allowed when deserializing Zookeeper distributed queue entries
#111 opened Aug 31, 2026 by Colhodm Loading…
@Colhodm
4
Restricting classes accepted during Zookeeper distributed queue deserialization (CWE-502)
#110 opened Aug 27, 2026 by Colhodm Loading…
@Colhodm
6
Re-validating the admin login redirect target to prevent open redirect
#109 opened Aug 27, 2026 by devin-ai-integration Bot Loading…
1
Restricting the classes that can be deserialized from Zookeeper queues
#108 opened Aug 26, 2026 by Colhodm Loading…
@Colhodm
4
Restrict ZookeeperDistributedQueue deserialization with an allow-list ObjectInputFilter
#107 opened Aug 20, 2026 by Colhodm Loading…
@Colhodm
4
Prevent open redirect via failureUrl/successUrl on admin login failure
#106 opened Aug 20, 2026 by devin-ai-integration Bot Loading…
1
Sandboxing MVEL rule evaluation to prevent remote code execution via rule injection
#105 opened Aug 19, 2026 by devin-ai-integration Bot Loading…
bug: prevent path traversal / arbitrary file write in admin asset upload
#104 opened Aug 19, 2026 by devin-ai-integration Bot Loading…
bug: reject path traversal in uploaded asset file names and asset writes
#103 opened Aug 19, 2026 by devin-ai-integration Bot Loading…
bug: sanitize static asset fullUrl and validate stored file extension
#102 opened Aug 19, 2026 by devin-ai-integration Bot Loading…
Restrict Zookeeper queue deserialization with an allow-list ObjectInputFilter
#101 opened Aug 19, 2026 by Colhodm Loading…
@Colhodm
4
Restricting ZookeeperDistributedQueue deserialization to an allow list of classes
#100 opened Aug 17, 2026 by Colhodm Loading…
@Colhodm
6
Restricting Zookeeper distributed queue deserialization to an allow-listed set of types
#99 opened Aug 13, 2026 by Colhodm Loading…
@Colhodm
5
Upgrading build to Java 21 and Spring Boot 3.5.16
#98 opened Aug 13, 2026 by kevinlrd Loading…
20
Fixing admin entity authorization bypass via client-controlled sectionCrumbs
#97 opened Aug 13, 2026 by kevinlrd Loading…
17
Removing raw MVEL fallback when persisting quantity-based rule match rules
#96 opened Aug 13, 2026 by kevinlrd Loading…
4
Restricting Zookeeper queue deserialization to an allow list of types (CWE-502)
#95 opened Aug 12, 2026 by Colhodm Loading…
@Colhodm
6
Restrict ZookeeperDistributedQueue deserialization with an allow-list ObjectInputFilter
#94 opened Aug 10, 2026 by Colhodm Loading…
@Colhodm
5
Strip path traversal from uploaded asset file names
#93 opened Aug 7, 2026 by devin-ai-integration Bot Loading…
ProTip! Filter pull requests by the default branch with base:develop-7.0.x.