3 ms·
> LoginClient.createNull().getUserInfo(...) should return a default response without actually talking to the third-party login service. This seems like a secur
by cluckindan 2y ago
> LoginClient.createNull().getUserInfo(...) should return a default response without actually talking to the third-party login service.
This seems like a security nightmare. In defense terms: here’s the side road to the castle with gates open, guarded by a single variable.
- jdlshore 2y agoHow are you imagining that variable gets flipped? If an attacker has the ability to run arbitrary code, you’re already screwed. To put it another way, somewhere in your code you do authorization: `if (isAuthorized) enterTheCastle()`. The gate to the castle, guarded by a single variable. In both cases, you have to be careful to program it correctly. In the case of Nullables, it’s easy to program it correctly. Multiple things would have to go wrong for the nulled version to be accidentally used in production. Also, unless you go out of your way to make a security vulnerability, Nullables’ default behavior is to do nothing. They default closed rather than open.
- knallfrosch 2y ago> How are you imagining that variable gets flipped? Not by an external actor, but by an internal bug.