3 ms·

> and can be implemented in Rust without any difficulty. Not really. You'd have to fight the language and pull in some crates, to be sure. There's no native ob

> and can be implemented in Rust without any difficulty. Not really. You'd have to fight the language and pull in some crates, to be sure. There's no native object serialization in rust and it's not really a concept in the language or ecosystem - except perhaps in the future with wasm runtimes. There are numerous details of log4j that, in general, just don't apply to rust code. edit: Since perhaps people don't believe me... Rust has no equivalent of JNDI, pickle, etc. There is no way to send rust 'code' except, perhaps, wasm. Certainly there's no well supported way with decades of history of being ingrained into libraries, or patterns that support it.

ploxiln 5y ago
Loading and running a java class is only the most absurd exploitation possibility with log4j. Without that, you can still slurp any environment variables (or other process information) and send it to any host. And you can probably do yet other stuff too, it is quite flexible ...
- staticassertion 5y ago
  > Loading and running a java class is only the most absurd exploitation possibility with log4j. Uh, yeah, the RCE was very bad. And not a thing with Rust due to not having object serialization. > you can still slurp any environment variables (or other process information) and send it to any host Yeah, you can write a logger in rust that does really crazy things like adding environment variables through some sort of parsing of a language construct. That would still be a problem, but a lot less serious. It would probably also be really unidiomatic, but that's a separate story.