3 ms·
1. Keep this link bookmarked. 2. Pull it off next time someone starts with the 'test-replace-static-typing' argument. 3. WIN
by fernandezpablo 14y ago
1. Keep this link bookmarked.
2. Pull it off next time someone starts with the 'test-replace-static-typing' argument.
3. WIN
- prodigal_erik 14y agoThis problem is due to deserialization creating object (sub)graphs which are unintentionally too powerful. Statically typed languages (especially without dependent types) can do this too, even when the root object(s) matches the type(s) expected by the caller. The cure is http://en.wikipedia.org/wiki/Capability-based_security http://en.wikipedia.org/wiki/Capability-based_security: write out what the caller is currently allowed to do, rather than blindly granting dangerous privileges and relying on the code's design never to use them. Even tainting, a very crude manual form, seems like it could have caught this.
- simonw 14y agoStruts2 had a similar vulnerability last year: http://websec.wordpress.com/2012/01/04/multiple-vulnerabilities-in-apache-struts2-and-property-oriented-programming-with-java/ http://websec.wordpress.com/2012/01/04/multiple-vulnerabilit...