Trusted computing base and reflective proxy message passing.

[Peter Firmstone <ji...@zeus.net.au>]

This article demonstrates a way we can avoid serialization security 
vulnerabilities.

http://www.ibm.com/developerworks/library/se-lookahead/index.html

I propose we make a list of safe classes for Serializable objects to 
limit the scope of classes an attacker can use.

If we allow all local interface classes, this will enable reflective 
proxys' to be used for message passing by untrusted parties.

So for users we could create two new constraints:

   1. TrustedObjectsConstraint - limiting serialization to trusted java
      platform and jini platform objects (limited by a pre audited list
      of classes), and no codebase downloads, reflective proxy only.
   2. InputStreamConstraint - to limit the bytes possible to be
      transferred via an InputStream used during unmarshalling.


Interested?

Regards,

Peter.