Page History

Object serialization allows saving an object's state as a sequence of bytes and its reconstitution at some a later time. The primary application of serialization is in Java Remote Method Invocation (RMI) wherein objects must be (un)packed and exchanged with other between distributed virtual machines. Usage It also finds extensive use in Java beans followsBeans.

Java language's access control mechanisms cease to remain effective after a class is serialized. Any Consequently, any sensitive data that was originally protected using private access qualifiers (such as the private keyword) gets exposed. Moreover, the security manager does not provide any checks to guarantee integrity of serialized data.

...

The data members of class coordinates Point are declared as private. The saveState and readState methods are used for serialization and de-serialization respectively. The coordinates (x,y) that are written to the data stream are now susceptible to malicious tampering.

public class coordinatesPoint {

 private double x;
 private double y;

 public coordinatesPoint(double x, double y) {
  this.x = x;
  this.y = y;
 }
 
 public void saveState(OutputStream out) throws IOException {
  DataOutputStream dout = new DataOutputStream(dout);
  dout.writeDouble(x);
  dout.writeDouble(y);
 }
 
 public void readState(InputStream in) throws IOException {
  DataInputStream din = new DataInputStream(in);
  this.x = din.readDouble(x);
  this.y = din.readDouble(y);
 }

}

...

Point()
 {
  //no argument constructor
 }
 
}

public class Coordinates extends Point implements Serializable {

 public static void main(String[] args)
 {
  try {
   Point p = new Point(5,2);
   FileOutputStream fout = new FileOutputStream("point.ser");
   ObjectOutputStream oout = new ObjectOutputStream(fout);
   oout.writeObject(p);
   oout.close();
  }
  catch (Exception e) {System.err.println(e);} 
 }
}

Compliant Solutions

In the absence of sensitive data, a class can be serialized by implementing the java.io.Serializable interface. By doing so, the class indicates that no security issues may result from the object's serialization. Note that any sub classes will also inherit this interface and will thus be serializable.

Not all classes can implement serializable. This is common when there are references to nonserializable objects within the contained methods. The following compliant solution avoids this issue and protects sensitive data members from getting serialized. The basic idea is to declare the target member as transient so that it is not included in the list of fields to be serialized, whenever default serialization is being used.

public class Point {

 private transient double x;
 private transient double y;

 public Point(double x, double y) {
  this.x = x;
  this.y = y;
 }

 public Point()
 {
  //no argument constructor
 }
 
}

public class Coordinates extends Point implements Serializable {

 public static void main(String[] args)
 {
  try {
   Point p = new Point(5,2);
   FileOutputStream fout = new FileOutputStream("point.ser");
   ObjectOutputStream oout = new ObjectOutputStream(fout);
   oout.writeObject(p);
   oout.close();
  }
  catch (Exception e) {System.err.println(e);} 
 }
}

Other ruses include custom implementation of writeObject, writeReplace and writeExternal methods such that sensitive fields are not written to the serialized stream or alternatively, conducting proper validation checks while de-serializing. Yet another remediation is to define the serialPersistentFields array field and ensuring that sensitive fields are not added to the array. Sometimes it is necessary to prevent a serializable object (whose superclass implements serializable) from getting serialized. This can be achieved by throwing a NotSerializableException from the custom writeObject() method.

References

Transient Keyword, http://java.sun.com/docs/books/jls/second_edition/html/classes.doc.html#78119^{Image Added}
Java I/O, by Elliotte Rusty Harold
Java Secure Coding, http://java.sun.com/security/seccodeguide.html^{Image Added}