Skip to content

Instantly share code, notes, and snippets.

@adsurbum
Created August 5, 2015 15:15
Show Gist options
  • Save adsurbum/bebe04c15cd27265e3ee to your computer and use it in GitHub Desktop.
Save adsurbum/bebe04c15cd27265e3ee to your computer and use it in GitHub Desktop.
json injection with Gson
class User{
public String name;
private Boolean havePermissions;
};
public static void main(String[] args) {
String input = "{name:hacker, havePermissions:true}";
Gson gson = new Gson();
User user = gson.fromJson(JsonSanitizer.sanitize(input), User.class);
if (user.name.equals("admin"))
user.havePermissions = true;
if (b.havePermissions)
System.out.println("OMFG");
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment