Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: SerializationUtils.deserialize() is deprecated #45

Closed
junghoon-vans opened this issue Feb 4, 2023 · 0 comments
Closed

fix: SerializationUtils.deserialize() is deprecated #45

junghoon-vans opened this issue Feb 4, 2023 · 0 comments
Assignees
Labels
🐛 bug 기능 상에 문제가 있는 경우를 명시합니다.

Comments

@junghoon-vans
Copy link
Member

junghoon-vans commented Feb 4, 2023

Description

SerializationUtils.deserialize 함수는 RCE 취약점으로 인해 더 이상 사용이 권고되지 않습니다.

// com/dnd/wedding/global/config/util/CookieUtil.java

public static <T> T deserialize(Cookie cookie, Class<T> cls) {
    return cls.cast(SerializationUtils.deserialize(
        Base64.getUrlDecoder().decode(cookie.getValue())));
  }

Solution

CookieUtil 내 해당 함수는 다른 방식으로 대체되어야 합니다.

Alternatives

No response

Additional Context

No response

@junghoon-vans junghoon-vans added the 🐛 bug 기능 상에 문제가 있는 경우를 명시합니다. label Feb 4, 2023
@junghoon-vans junghoon-vans self-assigned this Feb 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🐛 bug 기능 상에 문제가 있는 경우를 명시합니다.
Projects
None yet
Development

No branches or pull requests

2 participants