3 ms·
I'm probably inviting downvotes, but this paper's conclusion reads to me as "Object-Oriented Programming caused these exploits"
by misterbowfinger 10y ago
I'm probably inviting downvotes, but this paper's conclusion reads to me as "Object-Oriented Programming caused these exploits"
- nl 10y agoI don't see anything that is really object-oriented specific here. Yes, the terminology is all OO-based, but it is really about unauthorized access to code. There's nothing OO specific about it. For example: Twelve vulnerabilities abuse a confused deputy to call MethodHandles.lookup to get a lookup object on behalf of a system class. Such a lookup object can be used by malicious code to access members that are accessible to the system class, but that should be inaccessible to untrusted code This vulnerability would be exactly the same in principle if it was a functional or imperative programming. Loosely bound code is loaded into the incorrect security context and exploited. In a very loose sense, it is similar to https://www.cvedetails.com/cve/CVE-2012-3479/ https://www.cvedetails.com/cve/CVE-2012-3479/, which is an EMACS Lisp bug cause by incorrect checks[1]. OO or Functional - bugs like this are the same thing. [1] http://www.openwall.com/lists/oss-security/2012/08/13/1 http://www.openwall.com/lists/oss-security/2012/08/13/1