Crystallizer: A Hybrid Path Analysis Framework to Aid in Uncovering Deserialization Vulnerabilities-Reference-Cited by-同舟云学术

Crystallizer: A Hybrid Path Analysis Framework to Aid in Uncovering Deserialization Vulnerabilities

Published:2023-11-30 Issue: Volume: Page:
ISSN:
Container-title:Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering
language:
Short-container-title:

Author:

Srivastava Prashast¹,Toffalini Flavio²,Vorobyov Kostyantyn³,Gauthier François³,Bianchi Antonio¹,Payer Mathias²

Affiliation:

1. Purdue University, West Lafayette, USA

2. EPFL, Lausanne, Switzerland

3. Oracle Labs, Brisbane, Australia

Funder

ERC

AFRL

SNSF

Publisher

ACM

Link

https://dl.acm.org/doi/pdf/10.1145/3611643.3616313

Reference52 articles.

1. Apache. 2022. Apache Commons Collections Library. https://commons.apache.org/index.html Apache. 2022. Apache Commons Collections Library. https://commons.apache.org/index.html

2. Apache. 2022. Denylist for Java-based deserialization. https://github.com/apache/kafka/blob/trunk/connect/runtime/src/main/java/org/apache/kafka/connect/util/SafeObjectInputStream.java Apache. 2022. Denylist for Java-based deserialization. https://github.com/apache/kafka/blob/trunk/connect/runtime/src/main/java/org/apache/kafka/connect/util/SafeObjectInputStream.java

3. Apache. 2022. Java deserialization in Apache Pulsar. https://pulsar.apache.org/docs/v2.0.1-incubating/functions/api/#java-serde Apache. 2022. Java deserialization in Apache Pulsar. https://pulsar.apache.org/docs/v2.0.1-incubating/functions/api/#java-serde

4. Apache. 2022. Kafka—Distributed event streaming platform. https://github.com/apache/kafka Apache. 2022. Kafka—Distributed event streaming platform. https://github.com/apache/kafka

5. Apache. 2022. Lack of serialization filtering in Apache Pulsar. https://github.com/apache/pulsar/blob/master/pulsar-functions/api-java/src/main/java/org/apache/pulsar/functions/api/utils/JavaSerDe.java Apache. 2022. Lack of serialization filtering in Apache Pulsar. https://github.com/apache/pulsar/blob/master/pulsar-functions/api-java/src/main/java/org/apache/pulsar/functions/api/utils/JavaSerDe.java

Cited by 1 articles. 订阅此论文施引文献订阅此论文施引文献，注册后可以免费订阅5篇论文的施引文献，订阅后可以查看论文全部施引文献

1. Automated Data Binding Vulnerability Detection for Java Web Frameworks via Nested Property Graph;Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis;2024-09-11