search

frohoff / ysoserial

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
http://frohoff.github.io/appseccali-marshalling-pickles/
MIT License
7.75k stars 1.76k forks source link

JDK Multiple Version Execution Scaffolding #30

Open frohoff opened 8 years ago

frohoff commented 8 years ago

For running tests across different JDK versions to generate JDK/gadget support matrix, as well as executing generator/exploit(s). Probably something with Docker.

Marcono1234 commented 10 months ago

Related to https://github.com/frohoff/ysoserial/issues/10#issuecomment-1868298693, it seems Gradle Test Suites can also specify different JDK versions using toolchains, here is an example (not sure if this still works with the latest Gradle versions).

The advantage of Gradle toolchains is that Gradle takes care of downloading the JDK version if the user does not have it locally yet, so the user does not have to do this themselves.

However, assuming that some of the payloads require older unpatched JDKs, I don't know if it is possible or how easy it will be to obtain them using Gradle toolchains. And maybe that could also represent a security risk for the developer in case Gradle then uses those unpatched JDKs for other project builds as well since the major version requirement is satisfied.

So maybe it would be easier to just have the GitHub / Travis CI run with multiple JDK versions.