3 ms·
The interesting part is that it's also your responsibility to audit deserializer code in your dependencies.
by tetromino_ 4y ago
The interesting part is that it's also your responsibility to audit deserializer code in your dependencies.
- chrismorgan 4y agoThat’s still just a normal aspect of code. If you care about security, you have to audit all your dependencies. Security concerns in deserialising come about due to the input being able to control things, things like Python’s Pickle protocol where you get arbitrary object instantiation and function calls, even of things like os.system (pickle.loads(b"cos\nsystem\n(S'echo ACE'\ntR.")). Security cannot reasonably be retrofitted to such a model. With the likes of Serde (and indeed structural serialisers/deserialisers in practically every ahead-of-time-compiled language), this isn’t an issue: only the code controls things, and only types that declare a way of deserialising can be deserialised to.