4 ms·
LINQ expression trees can be serialized with a custom serializer, but it's a mistake to do so for a different reason: deserializers which materialize code or su
by barrkel 3y ago
LINQ expression trees can be serialized with a custom serializer, but it's a mistake to do so for a different reason: deserializers which materialize code or substitutes for code are major vulnerability vectors. Anyone who has had to upgrade Jackson or remove naive pickling will be familiar.
- neonsunset 3y agoArguably, as long as you don’t allow specifying arbitrary types in the serialized format, it should be safe as you can’t otherwise construct gadgets to produce unexpected side effects.