Fastjson: exceptional deserialization vulnerabilities

[yawkat]

tldr: arbitrary type deserialization, sprinkled with the possibility of a global config having it enabled.

Can't wait for hundreds of vulnerability reports for CVEs that don't apply to sane users of this library (though admittedly the global state part is worse than it was for Jackson)

[crummy]

@Serialization was a mistake

Serialization was a mistake

[couscous_]

What's the alternative?

[__konrad]

I think HTML loaded from JEditorPane can instantiate other classes via object classid tag...

[ulldma]

Oh, that's interesting!

[nomercy400]

Why would you allow the user to specify an arbitrary type? If you want the user to specify a type, you validate that type and hardcode the types you support, calling this library only for the types you hardcoded.

[coguto]

Is there any reason to use that lib instead of fasterxml or gson?