3 ms·
1. Define exactly what the deserialization output should be. 2. Implement it that exactly that way. Now it's simple. Does the definition in part (1) include exe
by ambrop7 13y ago
1. Define exactly what the deserialization output should be.
2. Implement it that exactly that way.
Now it's simple. Does the definition in part (1) include execution of arbitrary commands?
- Robin_Message 13y agoA deserializer might be able to instantiate arbitrary classes, so any class with a constructor that could execute an arbitrary command makes the deserializer vulnerable. Of course, the correct answer is not to use the deserializer that can instantiate arbitrary classes when you have a well-defined list of classes that can be instantiated.