Page History

The serialization Serialization and deserialization features can be exploited to bypass security manager checks. A serializable class may install contain security manager checks in its constructors for various reasons, including preventing untrusted code from modifying the internal state of the class. Such security manager checks must be replicated at all points where a class instance can be constructed. Because deserialization acts like a constructor, all the relevant methods must contain all relevant security checks. If the So if a class enables a caller to retrieve sensitive internal state contingent upon security checks, the same checks must be replicated during deserialization. This ensures that an attacker cannot extract sensitive information by deserializing the object.

...

...