Page History

...

If the class enables a caller to retrieve sensitive internal state contingent upon security checks, the same checks must be replicated during deserialization. This ensures that an attacker cannot glean sensitive information by serializing the object.

Noncompliant Code Example

In this noncompliant code example, security manager checks are used within the constructor but are not replicated within the writeObject() and readObject() methods that are used in the serialization-deserialization process. This allows untrusted code to maliciously create instances of the class.

public final class CreditCard implements Serializable {
  // Private internal state
  private String credit_card;
  private static final String DEFAULT = "DEFAULT";

  public CreditCard() {
    // Initialize credit_card to default value
    credit_card = DEFAULT;
  }

  // Allows callers to modify (private) internal state
  public void changeCC(String newCC) {
    if (credit_card.equals(newCC)) {
      // No change
      return;
    } else {  
      validateInput(newCC);
      credit_card = newCC;
    }
  }

  // readObject() correctly enforces checks during deserialization
  private void readObject(ObjectInputStream in)  throws IOException {
    in.defaultReadObject();
    // If the deserialized name does not match the default value normally
    // created at construction time, duplicate the checks
    if (!DEFAULT.equals(credit_card)) {
      validateInput(credit_card);
    }
  }

  // Allows callers to retrieve internal state
  String getValue() {
    return credit_card;
  }

  // writeObject() correctly enforces checks during serialization
  private void writeObject(ObjectOutputStream out)  throws IOException {
    out.writeObject(credit_card);
  }
}

Compliant Solution

This compliant solution implements the required security manager checks in all constructors and methods that can either modify or retrieve internal state. As a result, an attacker cannot create a modified instance of the object (using deserialization) or read the serialized byte stream to uncover sensitive serialized data.

...

Refer to the guideline SEC08-J. Enforce security checks in code that performs sensitive operations to learn about implementing the performSecurityManagerCheck() method.

Risk Assessment

Allowing serialization or deserialization to bypass the Security Manager may result in sensitive data being exposed or modified.

Automated Detection

TODO

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

\[[SCG 07|AA. Java References#SCG 07]\] Guideline 5-3 Duplicate the SecurityManager checks enforced in a class during serialization and deserialization
\[[Long 05|AA. Java References#Long 05]\] Section 2.4, Serialization

...