2 ms·
>I personally think allowing arbitrary string -> class lookup for all classes in the runtime is automatically a security code smell at best if not outright anti
by brazzy 4y ago
>I personally think allowing arbitrary string -> class lookup for all classes in the runtime is automatically a security code smell at best if not outright antipattern, but I don't think this is at all well understood yet.
Spot on. Case in point: the maintainer of snakeyaml furiously arguing that a similar vulnerability in his code is the fault of absolutely everything (client code, any code that can be used as a deserialization gadget, "low quality tooling") except his code: https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-202...
- richbell 4y ago> It only concludes that a YAML may execute code. This is *intentional* - this is why people use YAML (otherwise they may use JSON) ... > 100% of the application which use SnakeYAML do not parse data from untrusted sources. Wow, what a trainwreck of a thread. I don't know Jonathan but I would love to buy him a beer. Thank you for sharing. ;)
- nucleardog 4y agoI’m so confused about how many times it’s reiterated that _no one_ is parsing untrusted YAML with the library. It’s so unlikely as to be laughable. Then later when someone says they are, he doubles down saying that parsing arbitrary YAML provided from people on the internet isn’t parsing “untrusted” YAML because they’re authenticated. Apparently it’s reasonable that anyone that signs up for a SaaS service gets code execution privileges on the prod infrastructure? I’m pretty sure that thread had me shaking my head hard enough to give me a concussion.