Page History

...

final class BadSer implements Serializable { 	
  File f;
  public BadSer() throws FileNotFoundException {
    f  = new File(""c:\\filepath\\filename"");
  }	 
}

Compliant Soluton

This compliant solution shows a final class Ser that does not implement java.io.Serializable. Consequently, the File object cannot be serialized.

final class Ser { 	
  File f;
  public BadSer() throws FileNotFoundException {
    f  = new File(""c:\\filepath\\filename"");
  }	 
}

Compliant Solution

This compliant solution declares the File object transient. Consequently, the file path is not exposed.

final class Ser implements Serializable { 	
  transient File f;
  public BadSer() throws FileNotFoundException {
    f  = new File(""c:\\filepath\\filename"");
  }	 
}

Risk Assessment

Deserializing direct handles to system resources can allow the modification of the resources being referred to.

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[Sun 06|AA. Java References#Sun 06]\] ""Serialization specification""

...

SER37-J. Do not deserialize from a privileged context            14. Serialization (SER)            14. Serialization (SER)