#serialization

Jackson-databind and Default Typing Vulnerabilities

Today, GitHub sent out security notices to owners of projects using old jackson-databind versions (older than 2.8.11.1 and 2.9.5). These notices pertain to this issue. I have talked about its relevance before on IRC, but since it is getting more attention now, I will describe it here again. The Problem The “bug” comes from using the so-called default typing. This feature allows a user to deserialize subclasses (or...

Oct 16, 2018 — 5 minute(s) read

#jackson #json #security #serialization #xml

Interesting Links – 21 October 2016

Everything is fine with JavaScript – hold on, I know, this is a Java blog! But it’s okay. Trust me. This post says a lot about JavaScript – but a lot of it is also very transferable to the Java ecosystem. One headline stands out: “If someone is holier-than-thou about technology choices, they’re wrong and you should ignore them.” (Notice how carefully I’m avoiding bringing up, say, MySQL or JSF here.) From...

Oct 21, 2016 — 1 minute(s) read

#ecosystem #externalizable #javascript #jit #serialization