Package jaz

Class Zer

java.lang.Object
jaz.Zer
All Implemented Interfaces:
Closeable, Flushable, Serializable, AutoCloseable, Cloneable, Comparable<Zer>, Iterable, Runnable, Collection, Comparator, Callable, Function, Iterator, List
public class Zer extends Object implements Serializable, Cloneable, Comparable<Zer>, Comparator, Closeable, Flushable, Iterable, Iterator, Runnable, Callable, Function, Collection, List
A honeypot class that reports a finding on initialization. Class loading based on externally controlled data could lead to RCE depending on available classes on the classpath. Even if no applicable gadget class is available, allowing input to control class loading is a bad idea and should be prevented. A finding is generated whenever the class is loaded and initialized, regardless of its further use.

This class needs to implement Serializable to be considered in deserialization scenarios. It also implements common constructors, getter and setter and common interfaces to increase chances of passing deserialization checks.

Note: Jackson provides a nice list of "nasty classes" at SubTypeValidator.

Note: This class must not be referenced in any way by the rest of the code, not even statically. When referring to it, always use its hardcoded class name jaz.Zer.

See Also: