CVE-2024-39315: Overly Broad Protobuf Serialization
Unconditionally serializing a potentially sensitive protocol buffer or data object (like Session, User, or Profile) and preparing it for direct JSON inclusion via `json.RawMessage` can unintentionally expose sensitive excess data. Explicitly construct and map only the necessary, safe fields to a separate structure before serialization to avoid data leaks.
Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0
Goβ
Goβgreprules fetch cve-2024-39315-overly-broad-protobuf-serialization --engine opengrepDescription
Unconditionally serializing a potentially sensitive protocol buffer or data object (like Session, User, or Profile) and preparing it for direct JSON inclusion via `json.RawMessage` can unintentionally expose sensitive excess data. Explicitly construct and map only the necessary, safe fields to a separate structure before serialization to avoid data leaks.
Community feedback
0 signals from signed-in users.
- Useful
- 0
- False positive
- 0
- Metadata
- 0