Cole-Greer commented on code in PR #3578: URL: https://github.com/apache/tinkerpop/pull/3578#discussion_r3668567894
########## THREAT_MODEL.md: ########## @@ -394,7 +398,12 @@ Per-surface trust table: allow-list (`registrationRequired=true`), so it is not an arbitrary-instantiation sink, and a break within that locked config is a `VALID` bug like any deserializer. **Running Gryo unlocked (`registrationRequired=false`) is not a safe boundary against untrusted bytes and is the user's - responsibility.** (A few registered types use Java native serialization, a gadget caveat even when locked.) + responsibility.** A few registered types are also serialized with Kryo's `JavaSerializer`, which reads by way of + `ObjectInputStream.readObject()` and is a gadget caveat even when locked. As of 3.7.7 the mappers the IO paths Review Comment: > As of 3.7.7 I don't think we should encode the development history in the threat model. I think these edits should simply ensure that the current state of the model will accurately reflect 3.7-dev:head once the PR has merged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
