| Wiki Markup |
|---|
""An inner class is a nested class that is not explicitly or implicitly declared {{static}}."" \[[JLS 05|AA. Java References#JLS 05]\]. Serialization of inner classes (including local and anonymous classes) is error prone. According to the Serialization Specification \[[Sun 06|AA. Java References#Sun 06]\]: |
...
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[API 06|AA. Java References#API 06]\] \[[JLS 05|AA. Java References#JLS 05]\] [Section 8.1.3, Inner Classes and Enclosing Instances|http://java.sun.com/docs/books/jls/third_edition/html/classes.html] \[[Sun 06|AA. Java References#Sun 06]\] ""Serialization specification: \[[Bloch 08|AA. Java References#Bloch 08]\] Item 74: ""Implement serialization judiciously"" |
...
SER32-J. Do not allow serialization and deserialization to bypass the Security Manager 14. Serialization (SER) SER34-J. Make defensive copies of private mutable components