On Wed, Jan 13, 2021 at 4:47 AM Tom Hintz <[email protected]> wrote: > What infrastructure is available to validate gRPC messages prior to > deserialization to protect against CWE-502 attacks? Reference: > > MITRE CWE-502 Description > <https://cwe.mitre.org/data/definitions/502.html> >
I wouldn't say there is any general support to manage attacks like that, because you shouldn't be using such marshalling formats unless you trust the remote. Protobuf, JSON (depending on parser), Flatbuffers, etc are much more restricted than Java serialization and Python pickle and don't allow specifying arbitrary classes. Some languages may have APIs that would let you do some validation if you were so inclined. For example, in Java you could use an interceptor along with ServerInterceptors.useInputStreamMessages() <https://grpc.github.io/grpc-java/javadoc/io/grpc/ServerInterceptors.html#useInputStreamMessages-io.grpc.ServerServiceDefinition-> so that the interceptor observes the message before it is deserialized. But solutions like that are very language-specific. Obviously a proxy would be a cross-language solution. -- You received this message because you are subscribed to the Google Groups "grpc.io" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/grpc-io/CA%2B4M1oNuBvZAy6%2BKwe0DcBFBEvn1bxNSObZLEthCLDd3rFLYjw%40mail.gmail.com.
smime.p7s
Description: S/MIME Cryptographic Signature
