Re:Finding an authorization bypass on my own website
by the_gipsy on Sunday March 06, 2022 @03:22AM
(#30575958)
> Perhaps more importantly, though, this bug is basically the exact type of bug that caused the log4shell fiasco: trying to be too "smart" with user provided values that should just be treated as "dumb" scalars.
Which is exactly the equivalent of using JSON.parse(). You will find more library combinations, and for many of them the options can't be considered bugs like you do for mysqljs here, and you definitely won't be able to catch it.
The solution is parsing beyond JSON.parse(). You can't have arbitrary user provided structures floating around your program.
Which is exactly the equivalent of using JSON.parse(). You will find more library combinations, and for many of them the options can't be considered bugs like you do for mysqljs here, and you definitely won't be able to catch it.
The solution is parsing beyond JSON.parse(). You can't have arbitrary user provided structures floating around your program.