You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@flink.apache.org by "Ted Yu (JIRA)" <ji...@apache.org> on 2017/04/29 19:32:04 UTC

[jira] [Created] (FLINK-6421) Unchecked reflection calls in PojoSerializer

Ted Yu created FLINK-6421:
-----------------------------

             Summary: Unchecked reflection calls in PojoSerializer
                 Key: FLINK-6421
                 URL: https://issues.apache.org/jira/browse/FLINK-6421
             Project: Flink
          Issue Type: Bug
            Reporter: Ted Yu
            Priority: Minor


Here is one example:
{code}
      String subclassName = source.readUTF();
      try {
        actualSubclass = Class.forName(subclassName, true, cl);
{code}
subclassName may carry tainted value, allowing an attacker to bypass security checks, obtain unauthorized data, or execute arbitrary code



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)