3 ms·
This seems to be a yet another manifestation of the same underlying issue that has marred this library since 2013: https://blog.sonatype.com/jackson-databind-r
by vesinisa 7y ago
This seems to be a yet another manifestation of the same underlying issue that has marred this library since 2013:
https://blog.sonatype.com/jackson-databind-remote-code-execution https://blog.sonatype.com/jackson-databind-remote-code-execu...
The only reliable fix is surely stopping serialization of arbitrary classes by not using or auditting any use of the DefaultTyping feature.
- lol768 7y ago>it is apparently on by default Curious as to what makes you think this - I was under the impression you needed to explicitly call `enableDefaultTyping` to get this unsafe behaviour. The wiki page explicitly tells you not to do this with untrusted input and the method is deprecated in the latest versions of the library. https://github.com/FasterXML/jackson-databind/issues/2195 https://github.com/FasterXML/jackson-databind/issues/2195 https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymo...
- vesinisa 7y agoFrom the blog I linked. They might have meant the feature was on by default in 2013. I edited that part away. Here is a much better blog by the library author themself: https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-...
- Iv 7y agoOr just admit it will always be an unsafe operation. There are cases where you trust the source.