Topic: java

• Deserialisation of untrusted data: pickle and Java serialization

  Native object serialisation formats instruct the receiver to construct arbitrary objects, and constructing objects runs code; Python's pickle documentation says outright that the module is not secure. Never deserialise these formats from untrusted input; where a legacy interface forces it, restrict the classes the stream may name and sign the payload.

  article · en · unreviewed

Machine-readable: JSON