5 ms·
https://capnproto.org https://capnproto.org serialisation scheme skips the decoding. Does that make it not safe?
by bmn__ 7y ago
https://capnproto.org https://capnproto.org serialisation scheme skips the decoding. Does that make it not safe?
- tebeka 7y agoNo serizalization is safe - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-028 https://docs.microsoft.com/en-us/security-updates/securitybu... - https://en.wikipedia.org/wiki/Billion_laughs_attack https://en.wikipedia.org/wiki/Billion_laughs_attack - https://en.wikipedia.org/wiki/Zip_bomb https://en.wikipedia.org/wiki/Zip_bomb - ...
- strbean 7y agoNone of those are serialization schemes. XML can be used for serialization, but if you look at the whole ecosystem it is a Turing-complete complexity monster, so of course it isn't safe.
- DougBTX 7y agoIt depends on what constraints apply to the data. Any bit pattern could be used for an int, but to guarantee a UTF-8 string it would need to be validated.