3 ms·
Dunno if I agree that libraries need reflection. Some do, but primarily in the dependency injection and testing space. That's not really where you'd expect RCE
by marginalia_nu 4y ago
Dunno if I agree that libraries need reflection. Some do, but primarily in the dependency injection and testing space.
That's not really where you'd expect RCE-problems.
- chowells 4y agoYeah, I should say where developers don't think they need to use reflection. Like, the log4j thing came from (among other design errors) choosing to use reflection to look up filters for processing data during logging. Why would log4j's developers possibly think reflection is an appropriate tool for making filters available? Because it's the easy option in Java. Because it's the easy option, people are already comfortable with it in other libraries. Because it's easy and comfortable, it's what gets done. Some languages make reflection much more difficult (or nearly impossible) and other APIs much easier. It's far more difficult to make that class of error in languages like that.