3 ms·

I'm not the grandparent, but there's been a slew of deserialization-related vulnerabilities in Java and .NET libraries where user input is used to instantiate a

I'm not the grandparent, but there's been a slew of deserialization-related vulnerabilities in Java and .NET libraries where user input is used to instantiate arbitrary classes and invoke methods on them.

Nursie 5y ago
Lot of them in jackson in recent years, IIRC.
- abhishekjha 5y ago
  Is that why ConcurrentHashmap uses a RB-tree in worst case scenario, as in if there are too many collisions in a bucket?
  - Nursie 5y ago
    I'm not sure that's related here? Jackson is a JSON and XML serialiser/deserialiser, and it has a bunch of ways to automatically serialise and deserialise things into objects, without being provided a template. This is where the danger lies, if you just let it do its thing it can be exploited as it will load classes that the input data asks for. There have been a number of RCEs about this in recent years I'm not sure what that has to do with the performance of concurrenthashmap under heavy collisions... ?
    - abhishekjha 5y ago
      If I understand correctly most of the query params or POST body JSON gets mapped to a hashmap via Jackson and then POJOs gets created which can actually be an attack vector in terms of collison. [0]https://fahrplan.events.ccc.de/congress/2011/Fahrplan/attachments/2007_28C3_Effective_DoS_on_web_application_platforms.pdf https://fahrplan.events.ccc.de/congress/2011/Fahrplan/attach... [1]https://openjdk.java.net/jeps/180 https://openjdk.java.net/jeps/180 [2]https://stackoverflow.com/questions/8669946/application-vulnerability-due-to-non-random-hash-functions https://stackoverflow.com/questions/8669946/application-vuln...
      - Nursie 5y ago
        OH fair enough, that's not the attack vector that I was referring to, which is a more simple "deserialise me to something that I can use to compromise you" message, but it's another interesting vector! Security really is hard to get right.
        abhishekjha 5y ago
        >"deserialise me to something that I can use to compromise you" Any paper/presentation that I can read? I seem to be having a hard time findin it.

Nursie 5y ago

Lot of them in jackson in recent years, IIRC.

abhishekjha 5y ago
Is that why ConcurrentHashmap uses a RB-tree in worst case scenario, as in if there are too many collisions in a bucket?
- Nursie 5y ago
  I'm not sure that's related here? Jackson is a JSON and XML serialiser/deserialiser, and it has a bunch of ways to automatically serialise and deserialise things into objects, without being provided a template. This is where the danger lies, if you just let it do its thing it can be exploited as it will load classes that the input data asks for. There have been a number of RCEs about this in recent years I'm not sure what that has to do with the performance of concurrenthashmap under heavy collisions... ?
  - abhishekjha 5y ago
    If I understand correctly most of the query params or POST body JSON gets mapped to a hashmap via Jackson and then POJOs gets created which can actually be an attack vector in terms of collison. [0]https://fahrplan.events.ccc.de/congress/2011/Fahrplan/attachments/2007_28C3_Effective_DoS_on_web_application_platforms.pdf https://fahrplan.events.ccc.de/congress/2011/Fahrplan/attach... [1]https://openjdk.java.net/jeps/180 https://openjdk.java.net/jeps/180 [2]https://stackoverflow.com/questions/8669946/application-vulnerability-due-to-non-random-hash-functions https://stackoverflow.com/questions/8669946/application-vuln...
    - Nursie 5y ago
      OH fair enough, that's not the attack vector that I was referring to, which is a more simple "deserialise me to something that I can use to compromise you" message, but it's another interesting vector! Security really is hard to get right.
      - abhishekjha 5y ago
        >"deserialise me to something that I can use to compromise you" Any paper/presentation that I can read? I seem to be having a hard time findin it.