Abhishek14
Insecure use of binary_to_term
It is recommended not to use binary_to_term. what is the secure way to use it.
Most Liked
realcorvus
For those coming from google,
NOT SAFE: :erlang.binary_to_term(user_input, [:safe])
SAFE: Plug.Crypto.non_executable_binary_to_term(user_input, [:safe])
This is extremely important if your application passes user input to binary_to_term. The $425 million Equifax breach happened due to an Apache Struts web app that was vulnerable to RCE. Java is to Struts what Ruby is to Rails and Elixir is to Phoenix.
Article with some more details about how this happened in the paginator library: Elixir/Phoenix Security: Remote Code Execution and Serialisation
voltone
This may help: Serialisation and deserialisation | EEF Security WG
Popular in Discussions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Practical resources that improve the lives of professional developers.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #advent-of-code
- #elixirconf-us
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Real-time error tracking, performance insights, and observability for devs.
Practical resources that improve the lives of professional developers.
Develop your skills with books, videos, and courses.
Enabling companies to succeed by building software people love.
Courses that'll move you from confusion to "Aha, now I get it!"