11 ms·
That only works because Python is an interpreter. Won't cause a thing on Java.
by bitL 8y ago
That only works because Python is an interpreter. Won't cause a thing on Java.
- joshuamorton 8y agoDeserialization in Java requires reflection, which puts you firmly in the land of "I'm basically interpreted now". Javas serialization has basically the same set of vulnerability.
- dwaite 8y agoThe JRE has had arbitrary code execution attacks on serialization. The leaked classes eventually invoke a class loader and instantiate your binary code as a new java class.
- bitL 8y agoDoes the serialization work with bytecode though? Doesn't it stream just data members, not method implementations?
- icebraining 8y agoThe JVM is a Java Bytecode interpreter; don't be so sure you can't make it run things.