Spring Framework: Difference between revisions

Revision as of 06:31, 13 October 2023

Revision as of 06:31, 13 October 2023

Line 18:

}}

The '''Spring Framework''' is an [[application framework]] and [[inversion of control]] [[Servlet container|container]] for the [[Java platform]].{{sfn | Deinum | Rubio | Long | Mak | 2014 | loc=§2 Spring Core Tasks | p=47}} The framework's core features can be used by any Java application, but there are extensions for building [[web application]]s on top of the [[Java EE]] (Enterprise Edition) platform. The framework does not impose any specific [[programming model]].{{Citation needed|reason=Spring Web Flux Framework heavily uses the functional-programming paradigm according to Deinum and Cosmina's "Pro Spring MVC with WebFlux". Need supporting information for the claim that the framework does not impose any specific programming model|date=June 2023}}. The framework has become popular in the Java community as an addition to the [[Enterprise JavaBeans]] (EJB) model.{{sfn | Deinum | Rubio | Long | Mak | 2014 | loc=§16-2 Integrating Two Systems Using JMS | pp=694-698}} The Spring Framework is [[Free and open-source software|free and open source software]].{{sfn|Johnson|Hoeller|2004}}{{rp | pp=121–122}}{{sfn|Deinum|Cosmina|2021|loc=§1 Setting up a Local Development Environment | p=1}}

==Spring4Shell vulnerability==

{{See also | Log4Shell}}

A [[remote code execution]] vulnerability affecting certain versions of Spring Framework was published in April 2022 under {{CVE|2022-22965}}. It was given the name ''Spring4Shell'' in reference to the recent [[Log4Shell]] vulnerability, both having similar proofs-of-concept in which attackers could gain shell access on vulnerable machines.<ref>{{Cite web |url=https://www.kaspersky.com/blog/spring4shell-critical-vulnerability-in-spring-java-framework/44034/ |title=Spring4Shell: critical vulnerability in Spring - Kaspersky official blog }}</ref>

==See also==