4 ms·
If I understand correctly most of the query params or POST body JSON gets mapped to a hashmap via Jackson and then POJOs gets created which can actually be an a
by abhishekjha 5y ago
If I understand correctly most of the query params or POST body JSON gets mapped to a hashmap via Jackson and then POJOs gets created which can actually be an attack vector in terms of collison.
[0]https://fahrplan.events.ccc.de/congress/2011/Fahrplan/attachments/2007_28C3_Effective_DoS_on_web_application_platforms.pdf https://fahrplan.events.ccc.de/congress/2011/Fahrplan/attach...
[1]https://openjdk.java.net/jeps/180 https://openjdk.java.net/jeps/180
[2]https://stackoverflow.com/questions/8669946/application-vulnerability-due-to-non-random-hash-functions https://stackoverflow.com/questions/8669946/application-vuln...
- Nursie 5y agoOH fair enough, that's not the attack vector that I was referring to, which is a more simple "deserialise me to something that I can use to compromise you" message, but it's another interesting vector! Security really is hard to get right.
- abhishekjha 5y ago>"deserialise me to something that I can use to compromise you" Any paper/presentation that I can read? I seem to be having a hard time findin it.