Page History

...

Other ruses include custom implementation of writeObject, writeReplace and writeExternal methods such that sensitive fields are not written to the serialized stream or alternatively, conducting proper validation checks while de-serializing. Yet another remediation is to define the serialPersistentFields array field and ensuring that sensitive fields are not added to the array. Sometimes it is necessary to prevent a serializable object (whose superclass implements serializable) from getting serialized. This can be achieved by throwing a NotSerializableException from the custom writeObject() method.

Risk Assessment

TODOIf sensitive data can be serialized then it may be transmitted over an insecure link, or stored in an insecure medium, and thereby released inappropriately.

Automated Detection

...

Search for vulnerabilities resulting from the violation of this rule on the CERT website.

References

AP
\[[JLS 05|AA. Java References#JLS 05]\] [Transient modifier|

http://java.sun.com/docs/books/jls/

third_edition/html/classes.

Image Removed

http://java.sun.com/security/seccodeguide.html^{Image Removed}

html#37020]  
\[[Harold 99|AA. Java References#Harold 99]\]
\[[SCG 07|AA. Java References#SCG 07]\]