Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

"An inner class is a nested class that is not explicitly or implicitly declared static" [JLS 2005]. Serialization of inner classes (including local and anonymous classes) is error prone. According to the Serialization Specification [Sun 2006]:

  • Serializing an inner class declared in a non-static context that contains implicit non-transient references to enclosing class instances results in serialization of its associated outer class instance.

...

MITRE CWE

CWE-499, "Serializable Class Containing Sensitive Data"

Bibliography

...

      Rule 14: Serialization (SER)Image Added