diff --git a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp index 087a873dfc77..bf7205d535ff 100644 --- a/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp +++ b/java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp @@ -64,8 +64,8 @@ Recommendations specific to particular frameworks supported by this query:

SnakeYAML - org.yaml:snakeyaml

Secure by Default: No
Recommendation: Pass an instance of org.yaml.snakeyaml.constructor.SafeConstructor to org.yaml.snakeyaml.Yaml's constructor before using it to deserialize untrusted data.
Secure by Default: As of version 2.0.
Recommendation: For versions before 2.0, pass an instance of org.yaml.snakeyaml.constructor.SafeConstructor to org.yaml.snakeyaml.Yaml's constructor before using it to deserialize untrusted data.

XML Decoder - Standard Java Library

@@ -121,7 +121,7 @@ Alvaro Muñoz & Christian Schneider, RSAConference 2016:

SnakeYaml documentation on deserialization: -SnakeYaml deserialization. +SnakeYaml deserialization (not updated for new behaviour in version 2.0).

Hessian deserialization and related gadget chains: pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.

Alternative Proxies: