Page History

MITRE CWE

CWE-502, "Deserialization of Untrusted Data"

Secure Coding Guidelines for the Java Programming Language, Version 3.0

Guideline 5-3. View deserialization the same as object construction

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4fe3821fbca6e774-6ae1ba75-4ae44e41-a7218b37-a754ae6bfef4074767c895b9"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

Class Object, Class Hashtable

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d8b9f2f05f1c06be-562b991f-40a34156-9f51b107-0800da04f4e59ff3dca0f1f0"><ac:plain-text-body><![CDATA[

[[Bloch 2008

AA. Bibliography#Bloch 08]]

Item 75, Consider using a custom serialized form

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="90f0c7e8eaeb6684-6ab6d80b-42574eca-824c991d-51d4a7516c657a2bd7631f8e"><ac:plain-text-body><![CDATA[

[[Greanier 2000

AA. Bibliography#Greanier 00]]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="22256c9d0c89f760-89896d83-4c8847eb-a2daa3a4-36b959df3e5eea882521ee80"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. Bibliography#Harold 99]]

Chapter 11, Object Serialization, Validation

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="1e18bcc49d6d2393-04edb4c7-4a354c00-9c32b87e-8b04f57668d41209f6302009"><ac:plain-text-body><![CDATA[

[[Hawtin 2008

AA. Bibliography#Hawtin 08]]

Antipattern 8. Believing deserialisation is unrelated to construction

]]></ac:plain-text-body></ac:structured-macro>