3 ms·
> and how general they are to other serialization interfaces? This class of problems was very common when that serialization appeared in Java. It was possible
by Const-me 8y ago
> and how general they are to other serialization interfaces?
This class of problems was very common when that serialization appeared in Java. It was possible to inject code into pretty much anything, e-mails (1), office documents (2), web pages. Since that time, most developers / managers have learned their lesson and started to pay attention / allocate resources so modern software/protocols/formats tend to be more secure, at least on average.
(1) https://en.wikipedia.org/wiki/ILOVEYOU https://en.wikipedia.org/wiki/ILOVEYOU
(2) https://en.wikipedia.org/wiki/Melissa_(computer_virus) https://en.wikipedia.org/wiki/Melissa_(computer_virus)
- dfox 8y agoExcept that (1) was completely normal executable program (albeit in not well-known "format", which windows has many) and was not in any way executed automatically (and has nothing to with Java). And (2) is VBA macro virus which again has nothing to do with Java.
- Const-me 8y agoThe comment I replied to specifically asked about other serialization interfaces. Both that VBS, and DOC/XLS, contain some code inside. But users though they are just data files, so they opened these things, running the code. Also, old MS office files were not limited to embedded VBA. They are OLE compound files, so a specially crafted file can create and run ActiveX objects (often implemented as Win32 DLLs registered under HKEY_CLASSES_ROOT key of the registry) installed on user’s system. This is very similar to the way Java serializer creates and runs objects when desterilizing data received from untrusted source.