Abhishek14
Insecure use of binary_to_term
It is recommended not to use binary_to_term. what is the secure way to use it.
Trending in Discussions
Other Trending Topics
Latest Phoenix Threads
Chat & Discussions>Discussions
Latest on Elixir Forum
Sponsor Spotlight
Enabling companies to succeed by building software people love.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #code-sync
- #javascript
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #elixirconf-us
- #websockets
- #supervisor
- #advent-of-code
- #distillery
- #processes
- #api
- #forms
- #metaprogramming
- #hex
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Error tracking, logs, uptime, and Just Enough APM. Built for developers.
Practical resources that improve the lives of professional developers.
Develop your skills with books, videos, and courses.
The deployment platform built for Elixir: PaaS ease, VPS control.
The team behind Membrane, Popcorn, LiveDebugger. Available for hire.
Courses that'll move you from confusion to "Aha, now I get it!"
First 3 of 3 Posts
Eiji
Since
binary_to_termisErlangAPI I would recommend to read:erlangmodule documentation:voltone
This may help: Serialisation and deserialisation | EEF Security WG
realcorvus
For those coming from google,
NOT SAFE:
:erlang.binary_to_term(user_input, [:safe])SAFE:
Plug.Crypto.non_executable_binary_to_term(user_input, [:safe])This is extremely important if your application passes user input to binary_to_term. The $425 million Equifax breach happened due to an Apache Struts web app that was vulnerable to RCE. Java is to Struts what Ruby is to Rails and Elixir is to Phoenix.
Article with some more details about how this happened in the paginator library: Elixir/Phoenix Security: Remote Code Execution and Serialisation