Please rebase on master and you should have a green build here, I updated JaCoCo which now gives us a green build on Java 13-EA.

Thanks @garydgregory looks like all checks passed now!

Thank you. Will a release be occurring soon that includes this mitigation?

@Siebes I hope so. I have been waiting for a 2.0.0 release of BeanUtils for a while.

Yes, I'm working towards that. Pardon my being remiss over it. I've been fairly busy lately.

I noticed this fix was merged into version 1.x and is part of the 1.9.4 tag. What's usually the timeline for getting a new version in maven?

I upgraded my lib to 1.9.4 and added the suggested opt-out to my code.

But PropertyUtilsBean.getSimpleProperty() is still throwing a "NoSuchMethodException" when trying to get the property of "class".

My code is

BeanMap beanMap = new BeanMap(myObject);
PropertyUtilsBean propertyUtils = new PropertyUtilsBean();
for (Object propertyNameObject : beanMap.keySet()) {
     String propertyName = (String) propertyNameObject;
     try {
          myObjPropertyValue = propertyUtils.getProperty(myObject, propertyName);
     } catch (IllegalAccessException | InvocationTargetException | NoSuchMethodException e) {
          Errors errors = ErrorUtils.createBindException();
          errors.reject("Error occured while returing property values and propertyName: %s", propertyName);
          throw new ErrorEnabledRuntimeException(errors);
     }

Your code is wrong. Change to..

BeanMap beanMap = new BeanMap(oldObject); 
PropertyUtilsBean propertyUtils = new PropertyUtilsBean(); 
propertyUtils.removeBeanIntrospector(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);

for (Object propertyNameObject : beanMap.keySet()) { 
   ...
}

Perfect. thanks @melloware

Just to follow up. If the security violation is because of trying to access the properties of "class" . Why not exclude "class" properties when building "BeanMap"?

I think the seucrity violation is being able to set the property using property utils. Reading it would be fine. the ability to manipulate it is what is a security issue.