Concept不可信数据反序列化
CWE-502
A software weakness in the CWE classification referring to a program deserializing data from an untrusted source, which may lead to security issues such as remote code execution.
Timeline (last 90 days)
Oct 14
SnakeYAML's default load() or new Yaml() supports !! type tags, which can trigger instantiation of arbitrary Java classes, corresponding to the CWE-502 untrusted data deserialization vulnerability; the defense is to use SafeConstructor, a Constructor whitelist, or LoaderOptions to restrict the types that can be parsed.
Unverified50%