If an application has an RMI API that's used internally (servers communicating with one another), is the information coming from those calls considered trusted or validation is still required?
I can't find a lot of details online on this. It seems that OWASP mentions it's untrusted, but I don't know how could it be unsafe if it's not publically exposed. Also, every connection is secured with TLS. If it's untrusted, can someone explain why?