spring-projects / spring-projects/spring-boot
Consider allowlist for import locations
Open
Nobody has claimed this yet.
theme: config-data
type: enhancement
- Dominant language
- Java
- Stars
- 81.5k
- Forks
- 42.7k
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 65
Description
Using spring.config.import could mean that files are accidentally exposed. It would be nice if an allowlist could be used to limit the locations that can be used.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how spring.config.import resolves and accesses locations. Determine the intended allowlist scope, matching rules, and behavior for disallowed imports before identifying the relevant configuration-import entry points. Done means the security behavior is specified, implemented, and covered by tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100