3 added 572 characters in body
source | link

I don't know enough about C#'s serialization to know whether it is a security risk, but I can tell you this:

In Java, it is not safe to unserialize untrusted data. There are a number of subtle security pitfalls that can really screw you over. If you are guru-level, you can probably avoid the pitfalls, but an average developer probably has no clue about the dangers.

Here are some examples of subtle points:

If you fully understand all of that and can keep it in your head, you may be a good candidate to write secure deserialization code that can safely handle untrusted byte streams. On the other hand, if you are a mere mortal (like me) who throws up their hands in disgust at the whole thing, then it might be prudent to ensure that you never deserialize untrusted data.

In the example you give of deserializing a cookie value, here is one plausible defense you could use to ensure you never deserialize an untrusted byte stream. When generating the cookie, you could compute a message authentication code (MAC) over the cookie name and value and append it to the cookie value. When receiving the cookie, you could check whether the MAC is valid. Your server would need to generate a random MAC key and store it securely, but it doesn't need to share this secret value with anyone else (other than all servers who are serving requests).

I don't know enough about C#'s serialization to know whether it is a security risk, but I can tell you this:

In Java, it is not safe to unserialize untrusted data. There are a number of subtle security pitfalls that can really screw you over. If you are guru-level, you can probably avoid the pitfalls, but an average developer probably has no clue about the dangers.

Here are some examples of subtle points:

If you fully understand all of that and can keep it in your head, you may be a good candidate to write secure deserialization code that can safely handle untrusted byte streams. On the other hand, if you are a mere mortal (like me) who throws up their hands in disgust at the whole thing, then it might be prudent to ensure that you never deserialize untrusted data.

I don't know enough about C#'s serialization to know whether it is a security risk, but I can tell you this:

In Java, it is not safe to unserialize untrusted data. There are a number of subtle security pitfalls that can really screw you over. If you are guru-level, you can probably avoid the pitfalls, but an average developer probably has no clue about the dangers.

Here are some examples of subtle points:

If you fully understand all of that and can keep it in your head, you may be a good candidate to write secure deserialization code that can safely handle untrusted byte streams. On the other hand, if you are a mere mortal (like me) who throws up their hands in disgust at the whole thing, then it might be prudent to ensure that you never deserialize untrusted data.

In the example you give of deserializing a cookie value, here is one plausible defense you could use to ensure you never deserialize an untrusted byte stream. When generating the cookie, you could compute a message authentication code (MAC) over the cookie name and value and append it to the cookie value. When receiving the cookie, you could check whether the MAC is valid. Your server would need to generate a random MAC key and store it securely, but it doesn't need to share this secret value with anyone else (other than all servers who are serving requests).

2 added 581 characters in body
source | link

I don't know enough about C#'s serialization to know whether it is a security risk, but I can tell you this:

In Java, it is not safe to unserialize untrusted data. There are a number of subtle security pitfalls that can really screw you over. If you are guru-level, you can probably avoid the pitfalls, but an average developer might be in dangerprobably has no clue about the dangers.

Here are some examples of subtle points:

If you fully understand all of that and can keep it in your head, you may be a good candidate to write secure deserialization code that can safely handle untrusted byte streams. On the other hand, if you are a mere mortal (like me) who throws up their hands in disgust at the whole thing, then it might be prudent to ensure that you never deserialize untrusted data.

I don't know enough about C#'s serialization to know whether it is a security risk, but I can tell you this:

In Java, it is not safe to unserialize untrusted data. There are a number of subtle security pitfalls that can really screw you over. If you are guru-level, you can probably avoid the pitfalls, but an average developer might be in danger.

Here are some examples of subtle points:

I don't know enough about C#'s serialization to know whether it is a security risk, but I can tell you this:

In Java, it is not safe to unserialize untrusted data. There are a number of subtle security pitfalls that can really screw you over. If you are guru-level, you can probably avoid the pitfalls, but an average developer probably has no clue about the dangers.

Here are some examples of subtle points:

If you fully understand all of that and can keep it in your head, you may be a good candidate to write secure deserialization code that can safely handle untrusted byte streams. On the other hand, if you are a mere mortal (like me) who throws up their hands in disgust at the whole thing, then it might be prudent to ensure that you never deserialize untrusted data.

1
source | link

I don't know enough about C#'s serialization to know whether it is a security risk, but I can tell you this:

In Java, it is not safe to unserialize untrusted data. There are a number of subtle security pitfalls that can really screw you over. If you are guru-level, you can probably avoid the pitfalls, but an average developer might be in danger.

Here are some examples of subtle points: