Add UnicastRemoteObject payload to SnakeYAML

mbechler / marshalsec

MIT License

3.39k stars 680 forks source link

Add UnicastRemoteObject payload to SnakeYAML #38

Closed JLLeitschuh closed 1 year ago

JLLeitschuh commented 1 year ago

Going to be completely honest, I haven't tested this, but I think it would work given that it looks like SnakeYAML does set the constructors as accessible during construction.

https://bitbucket.org/snakeyaml/snakeyaml/src/1d2c1cd365774876e8c7c63eace7e906c0aca2bf/src/main/java/org/yaml/snakeyaml/constructor/Constructor.java#lines-591

mbechler commented 1 year ago

Looks good to me. Thanks, also for your pointer to the SnakeYAML discussion.