Refactoring and cleanup#2733
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
…ging in FileDesc_tell
|
@gemini-code-assist review |
There was a problem hiding this comment.
Code Review
This pull request significantly hardens the engine against malicious assets and network messages by introducing several security layers. Key improvements include the implementation of a SavableClassFilter and a standalone J3OScanner utility to prevent unauthorized class instantiation from J3O files, as well as extensive bounds and size validation within the BinaryImporter and BinaryInputCapsule to mitigate buffer overflows and memory exhaustion. Additionally, XML loaders have been updated to use a new SecureXmlFactory that disables external entity resolution, and the networking layer now enforces maximum message sizes. Feedback suggests further hardening the binary importer by defining explicit upper bounds for class counts and data lengths to provide stronger protection against Denial of Service attacks via memory exhaustion.
some refactoring and hardening