Page Information

Title:	SER07-J. Do not use the default serialized form for classes with implementation-defined invariants
Author:	Dhruv Mohindra	Mar 03, 2009
Last Changed by:	David Svoboda	Aug 06, 2025
Tiny Link: (useful for email)	https://wiki.sei.cmu.edu/confluence/x/eTdGBQ
Export As:	Word · PDF

SEI CERT Oracle Coding Standard for Java (2)     Page: OBJ06-J. Defensively copy mutable inputs and mutable internal components     Page: SEC58-J. Deserialization methods should not perform potentially dangerous operations

Parent Page     Page: Rule 14. Serialization (SER)

• draft
• ser
• android-applicable
• rule
• analyzable
• deprecated-applet

Time	Editor
Aug 06, 2025 17:02	Amy Gale	View Changes
REM cost reform
Jan 31, 2025 01:02	Amy Gale	View Changes
Localize CodeSonar crossreferences to Java scope
Aug 06, 2021 09:31	Jon O'Donnell	View Changes
May 18, 2021 08:48	Michal Rozenau	View Changes
Parasoft Jtest 2021.1
Feb 26, 2021 09:46	Michal Rozenau
Parasoft Jtest 2020.2

External Links (10)
    https://docs.oracle.com/javase/8/docs/api/java/util/Hashtab…
    www.oracle.com/technetwork/java/seccodeguide-139067.html
    https://www.securecoding.cert.org/confluence/display/java/O…
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-050…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    www.rapid7.com/db/modules/exploit/multi/browser/java_atomic…
    https://docs.oracle.com/javase/8/docs/api/java/lang/Object.…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    cwe.mitre.org/data/definitions/502.html
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…

SEI CERT Oracle Coding Standard for Java (11)     Page: Rule AA. References     Page: Rule BB. Glossary     Page: MSC07-J. Prevent multiple instantiations of singleton objects     Page: CodeSonar_V     Home page: SEI CERT Oracle Coding Standard for Java     Page: SER03-J. Do not serialize unencrypted sensitive data     Page: Coverity     Page: Parasoft     Page: OBJ11-J. Be wary of letting constructors throw exceptions     Page: Parasoft_V     Page: CodeSonar