3 ms·

> Maybe AribitraryCodeAndDataSerialization Wait, what? Java serialization does not serialize and deserialize code. The only thing encoding behavior when serial

• quelltext 8y ago
  ... unless you override Java's default serialization behavior and build a whole lot of black magic. Apparently there are some vulnerabilities in the implementation, but they are not an inherent part of it as some people seem to think.
  • marcodave 8y ago
    > unless you override Java's default serialization behavior and build a whole lot of black magic. ...but then, if the developer is writing custom deserialization code that does black magic (like, executing the equivalent of eval() on a content of a String field), any serialized format is affected, be it binary, JSON, YAML, etc