3 ms·
The GP's point is if you're doing code deserialization, the definition of security is different. The data format having RCE bugs won't be as much of a concern,
by ludamad 10y ago
The GP's point is if you're doing code deserialization, the definition of security is different. The data format having RCE bugs won't be as much of a concern, while trusting the data source will be much more of a concern.
- xapata 10y agoWe redefine security for every project. Some projects can (de)serialize code and be secure. Others can't.