4 ms·
... unless you override Java's default serialization behavior and build a whole lot of black magic. Apparently there are some vulnerabilities in the implementa
by quelltext 8y ago
... unless you override Java's default serialization behavior and build a whole lot of black magic.
Apparently there are some vulnerabilities in the implementation, but they are not an inherent part of it as some people seem to think.
- marcodave 8y ago> unless you override Java's default serialization behavior and build a whole lot of black magic. ...but then, if the developer is writing custom deserialization code that does black magic (like, executing the equivalent of eval() on a content of a String field), any serialized format is affected, be it binary, JSON, YAML, etc