4 ms·
What you are looking for is not "OO language", but "dynamic interpreted language". In a traditionally compiled OO language like C++, classes cease to exist aft
by revelation 14y ago
What you are looking for is not "OO language", but "dynamic interpreted language".
In a traditionally compiled OO language like C++, classes cease to exist after compilation; there is no fully generic way to instantiate an object of a class by data determined at runtime. So this whole concept of deserializing to whatever the protocol specifies goes completely out of the door.
- jrochkind1 14y agoSo your conclusion is that dynamically interpreted languages are all insecure? (You can instantiate objects with classes specified by data in Java too, although Java isn't usually considered exactly dynamicaly interpreted. In fact, there was a very analagous bug in Spring, as mentioned in many places in this comment thread. But anyway, okay, sufficiently dynamically interpreted to allow instantiation of objects with classes chosen at runtime... is the root of the problem, you're suggesting, if everyone just used C++ it would be fine?)
- phil 14y ago"Interpreted" is too restrictive. For example, Objective C provides NSClassFromString().
- revelation 14y agoOne could argue that since every call goes through a runtime messaging framework, Objective C is really just an interpreted language with pre-JITed function bodies.