Page History

MITRE CWE

CWE ID 502, "Deserialization of Untrusted Data"

[Secure Coding Guidelines for the Java Programming Language, Version
3.0

http://www.oracle.com/technetwork/java/seccodeguide-139067.html]

Guideline 5-3 View deserialization the same as object construction

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="8b6ffa83c65a3a5d-b115102f-418e4ec7-95f6889b-364f015ab863761b31e032d7"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

Class Object, Class Hashtable

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="944af05e72509ab0-fbafa422-40094965-98329ff1-d8d598714a9139890ac4677f"><ac:plain-text-body><![CDATA[

[[Bloch 2008

AA. Bibliography#Bloch 08]]

Item 75: "Consider using a custom serialized form"

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d2b134d2810643d9-aa30a0b7-43774139-8ee29062-00df2ee9d11c7ea3f2bf3861"><ac:plain-text-body><![CDATA[

[[Greanier 2000

AA. Bibliography#Greanier 00]]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="96c5eb060a2a0907-14ff2d07-4553416a-9ebcb9c4-bf0e903a3fa8e42f798fdd82"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. Bibliography#Harold 99]]

Chapter 11: Object Serialization, Validation

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5b5e0ea2c2d296a4-793aaa49-4159443d-99899fe7-8a5cee17f142163ac161a770"><ac:plain-text-body><![CDATA[

[[Hawtin 2008

AA. Bibliography#Hawtin 08]]

Antipattern 8: Believing deserialisation is unrelated to construction

]]></ac:plain-text-body></ac:structured-macro>