Injecting Java Bytecode in XML for harmful purposes

Question

So I have been thinking whether there is a way to send an XML such that the XML contains code in (bytecode) that will be unintentionally executed by the JVM. I am using java so I think uncompiled code will not work. I think I need to inject bytecode in the XML to trick the JVM? I want to try to make sure that the web service that I am building is secure. I am using JAXB for xml marshalling unmarshalling and Jersey as the web service handler.

Answer 1

Unintentionally? I don't think so.

The JAXB marshaller is going to deserialize XML values into the state of a given object, but the class and its behavior will be decided by you. I don't see sending raw bytecode in the XML and doing anything harmful with it.

You could send a JSON object that your Java object could execute using Rhino, but that's hardly unintentional.

Your service might have other security issues, but Java byte code injection attack isn't one of them.

You should be validating all data sent to you before binding, anyway.