Absent#equals bugs after serializing / deserializing
See original GitHub issueAfter serializing / deserializing Absent instances won’t be the same (e.g. in an Apache Spark context with Kryo serialization).
Therefore the implementation below contains a bug. Why not just check if the two instances have the same class definition?
@Override public boolean equals(@Nullable Object object) {
return object == this;
}
Issue Analytics
- State:
- Created 6 years ago
- Comments:12 (9 by maintainers)
Top Results From Across the Web
Serialization Security Bugs Explained - Daniel Miessler
In order to go from that serialized format to usable data, some software package needs to unpack that content, figure it out, and...
Read more >Deserialization Bugs in the Wild - Medium
Insecure deserialization is a type of vulnerability that arises when an attacker is able to manipulate the serialized object and cause ...
Read more >serialization - Is this a bug in JSON.NET or Entity Framework ...
NET type that implements ISerializable to force it to be serialized as a normal JSON object. Since you don't owe the DbUpdateConcurrencyException class,...
Read more >Systematically Hunting for Deserialization Exploits - Mandiant
Deserialization vulnerabilities are a class of bugs that have plagued multiple languages and applications over the years.
Read more >Deserialization risks in use of BinaryFormatter and related types
NET Framework all versions .NET Core 2.1 - 3.1 .NET 5 and later. Warning. The BinaryFormatter type is dangerous and is not recommended...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Although Chris is right that making the specific change requested here wouldn’t hurt, I’m terrified to hear that people are serializing Guava types in ways like this. They’re going to have a lot of problems. I’m worried about creating any impression that Guava tries to work correctly in this kind of environment.
On Wed, Apr 5, 2017 at 11:34 AM, Michał Sobkiewicz <notifications@github.com
– Kevin Bourrillion | Java Librarian | Google, Inc. | kevinb@google.com
@lowasser I understand and totally agree, thank you.