Page Information

Title:	SER07-J. Do not use the default serialized form for classes with implementation-defined invariants
Author:	Dhruv Mohindra	Mar 03, 2009
Last Changed by:	Will Snavely	Feb 12, 2018
Tiny Link: (useful for email)	https://wiki.sei.cmu.edu/confluence/x/eTdGBQ
Export As:	Word · PDF

SEI CERT Oracle Coding Standard for Java (2)     Page: OBJ06-J. Defensively copy mutable inputs and mutable internal components     Page: SEC58-J. Deserialization methods should not perform potentially dangerous operations

Parent Page     Page: Rule 14. Serialization (SER)

• draft
• ser
• android-applicable
• rule
• analyzable

(458)	www.securecoding.cert.org/confluence/display/java/SER07-J.+…
(328)	https://www.securecoding.cert.org/
(294)	https://www.google.com/
(273)	wiki.sei.cmu.edu/confluence/display/java/SER07-J.+Do+not+us…
(80)	https://www.google.co.in/
(73)	www.securecoding.cert.org/confluence/display/java/Tech-edit
(53)	wiki.sei.cmu.edu/confluence/display/java/OBJ06-J.+Defensive…
(37)	www.securecoding.cert.org/confluence/display/java/SER08-J.+…
(32)	https://securecoding.cert.org/confluence/display/java/SER07…
(31)	securecoding.cert.org/confluence/display/java/SER07-J.+Do+n…

Time	Editor
Feb 12, 2018 22:02	Will Snavely	View Changes
Nov 16, 2017 14:43	Will Snavely	View Changes
Jan 05, 2017 14:54	Will Snavely	View Changes
Nov 03, 2015 19:00	Arthur Hicken	View Changes
added parasoft
Jun 26, 2015 11:53	Carol J. Lallier

External Links (10)
    https://docs.oracle.com/javase/8/docs/api/java/util/Hashtab…
    www.oracle.com/technetwork/java/seccodeguide-139067.html
    https://www.securecoding.cert.org/confluence/display/java/O…
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-050…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    www.rapid7.com/db/modules/exploit/multi/browser/java_atomic…
    https://docs.oracle.com/javase/8/docs/api/java/lang/Object.…
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…
    cwe.mitre.org/data/definitions/502.html
    https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?p…

SEI CERT Oracle Coding Standard for Java (9)     Page: Rule AA. References     Page: Rule BB. Glossary     Page: MSC07-J. Prevent multiple instantiations of singleton objects     Home page: SEI CERT Oracle Coding Standard for Java     Page: SER03-J. Do not serialize unencrypted sensitive data     Page: Coverity     Page: Parasoft     Page: OBJ11-J. Be wary of letting constructors throw exceptions     Page: Parasoft_V