Mesteriis Deserialization Parser Review
Review parser and loader attack surfaces.
Workflow
- Identify all attacker-controlled bytes, paths, URLs, archive entries, and structured documents.
- Trace into parser, loader, resolver, filesystem, network, or command use.
- Check safe loader modes, size limits, recursion/decompression limits, path normalization, symlink handling, and schema validation.
- Validate exploitability or mark proof gaps.
- Recommend a minimal defensive change.
Output
- input source
- parser/loader sink
- control weakness
- exploit path
- mitigation
- validation plan
Rule
Do not claim a parser bug from library reputation alone. Tie the concern to how this repo uses the parser.