Return-Path: X-Original-To: apmail-commons-dev-archive@www.apache.org Delivered-To: apmail-commons-dev-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 1EA51183AE for ; Sun, 8 Nov 2015 18:46:44 +0000 (UTC) Received: (qmail 97971 invoked by uid 500); 8 Nov 2015 18:46:43 -0000 Delivered-To: apmail-commons-dev-archive@commons.apache.org Received: (qmail 97828 invoked by uid 500); 8 Nov 2015 18:46:43 -0000 Mailing-List: contact dev-help@commons.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: "Commons Developers List" Delivered-To: mailing list dev@commons.apache.org Received: (qmail 97816 invoked by uid 99); 8 Nov 2015 18:46:43 -0000 Received: from Unknown (HELO spamd4-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Sun, 08 Nov 2015 18:46:43 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd4-us-west.apache.org (ASF Mail Server at spamd4-us-west.apache.org) with ESMTP id 08379C0845 for ; Sun, 8 Nov 2015 18:46:43 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd4-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -0.013 X-Spam-Level: X-Spam-Status: No, score=-0.013 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.008, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001] autolearn=disabled Authentication-Results: spamd4-us-west.apache.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mx1-eu-west.apache.org ([10.40.0.8]) by localhost (spamd4-us-west.apache.org [10.40.0.11]) (amavisd-new, port 10024) with ESMTP id V-egBOKot_6a for ; Sun, 8 Nov 2015 18:46:42 +0000 (UTC) Received: from mail-wi0-f175.google.com (mail-wi0-f175.google.com [209.85.212.175]) by mx1-eu-west.apache.org (ASF Mail Server at mx1-eu-west.apache.org) with ESMTPS id 7094F24DB4 for ; Sun, 8 Nov 2015 18:46:41 +0000 (UTC) Received: by wikq8 with SMTP id q8so56364596wik.1 for ; Sun, 08 Nov 2015 10:46:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:subject:to:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-type:content-transfer-encoding; bh=UxFNiPF5z8Ftt+A1OZrzf6cd6lq3s3m/KlI4XDRGtMY=; b=TvxphsyHTYCMDLhNe0Ufsizccdrm/7IC0BBmd/0yaGGump3GPJQbTymTgieXCSYZ7J RkjGaeI1FbfunJp0PY67mJ+TrnbFPQ68Gb5hYU12Z1yNzjc0DLZkjm0/WOP0TunFMCdo d7CQkkB80zd8qMBZYMYXCGgCorYmBb5I03csHAlj3HZQKNKwnvgkzCCSR5R4Gm+yr559 NVLDUc6afy+fKPgWwnmx34nv476wzTtx9a39wMQtIuOUVDg92Doy8BWdJegmtZ9HjYOt jAVCQwzm5OKQVu2+BqO9yxTJgEuW2nq/06pUUxtOGk08YKPgJQc+XplZ0cMUJ8rmFXiv pGwA== X-Received: by 10.195.13.135 with SMTP id ey7mr6205618wjd.25.1447008401204; Sun, 08 Nov 2015 10:46:41 -0800 (PST) Received: from ?IPv6:2a01:e35:2f71:31d0:ac0c:4d9a:2ee:87a9? ([2a01:e35:2f71:31d0:ac0c:4d9a:2ee:87a9]) by smtp.gmail.com with ESMTPSA id q3sm7607075wjr.34.2015.11.08.10.46.39 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 08 Nov 2015 10:46:40 -0800 (PST) Sender: Emmanuel Bourg Subject: Re: [collection][security] InvokerTransformer missused in java object serialisation exploits To: Commons Developers List References: <20151106222553.00002c57.ecki@zusammenkunft.net> <563D3E10.9010906@gmail.com> <20151107042531.00007385.ecki@zusammenkunft.net> <563DCED8.5030302@gmail.com> <563DD02D.1040501@apache.org> <563F2188.3090905@gmail.com> <563F40D3.5060503@apache.org> <563F585C.6000600@gmail.com> From: Emmanuel Bourg Message-ID: <563F988F.8070003@apache.org> Date: Sun, 8 Nov 2015 19:46:39 +0100 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <563F585C.6000600@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Le 08/11/2015 15:12, Thomas Neidhart a écrit : > with the default being: do not de-serialize InvokerTransformer? > Then I would be ok going that route. I like the idea too. I have a question though: do we use a common property enabling unsafe deserialization for all commons components, or do we use a property per component or even per class? Emmanuel Bourg --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org For additional commands, e-mail: dev-help@commons.apache.org