Are there any data binding libraries (deserialization, marshaling, pickling libraries) that do not have the class of weaknesses as the two CVEs (CVE-2022-22965, CVE-2010-1622)?
My understanding is as follows.
- Spring uses WebDataBinder [0].
-> CVEs: CVE-2022-22965 (Spring4Shell), CVE-2010-1622
-> CVE Fixes: First deny-list approach (2010), then partial allow-list approach (2022)
My understanding is as follows.
- Spring uses WebDataBinder [0]. -> CVEs: CVE-2022-22965 (Spring4Shell), CVE-2010-1622 -> CVE Fixes: First deny-list approach (2010), then partial allow-list approach (2022)
- Struts uses OGNL. -> CVEs: CVE-2017-5638 (Equifax breach), and others -> CVE Fixes: deny-list approach (-2017-)
If there are any for Java, can they be used with Spring Boot (Spring Framework)? Maybe there are some for in another programming language?
[0] https://docs.spring.io/spring-framework/docs/current/javadoc... > Special DataBinder for data binding from web request parameters to JavaBean objects.