...
It is still possible for an attacker to obtain uninitialized instances of SensitiveClass by catching NotSerializableException or by using a finalizer attack, see OBJ11-J. Be wary of letting constructors throw exceptions for more information. Therefore an unserializable class that extends a serializable class must always validate itself before executing any methods.
Exceptions
SER03:-EX0: Sensitive data that has been properly encrypted may be serialized.
...
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4a6996e6c45dc941-32e63f8f-42b34068-8e90b155-9b33c493fe0c155934d1a84d"><ac:plain-text-body><![CDATA[ | [[Bloch 2005 | AA. References#Bloch 05]] | Puzzle 83. Dyslexic monotheism | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="b192c59eeeb0b766-e9a910a3-4ef84a10-b5e89b2a-979fa72ef8320a5384c612df"><ac:plain-text-body><![CDATA[ | [[Bloch 2001 | AA. References#Bloch 01]] | Item 1. Enforce the singleton property with a private constructor | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4ebbcad12a108e54-ca2724c9-42794285-95498206-effd7aed7e0f6841ac97e2fe"><ac:plain-text-body><![CDATA[ | [[Greanier 2000 | AA. References#Greanier 00]] | [Discover the Secrets of the Java Serialization API | http://java.sun.com/developer/technicalArticles/Programming/serialization/] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="3e427b773d3458fa-8c863df0-44b047a5-84af8c3b-389c39b40a1e99a8772a63d9"><ac:plain-text-body><![CDATA[ | [[Harold 1999 | AA. References#Harold 99]] |
| ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="625dc0d3d9248eaf-285db02d-46d5485a-8f4cbf5d-a3e054da0a7f472399394b78"><ac:plain-text-body><![CDATA[ | [[JLS 2005 | AA. References#JLS 05]] | [Transient Modifier | http://java.sun.com/docs/books/jls/third_edition/html/classes.html#37020] | ]]></ac:plain-text-body></ac:structured-macro> |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="33fa8bb7a431dc42-6fd35295-46a94b93-ad029aca-4904d57e690a47c007301de0"><ac:plain-text-body><![CDATA[ | [[Long 2005 | AA. References#Long 05]] | Section 2.4, Serialization | ]]></ac:plain-text-body></ac:structured-macro> | |
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="bc77f5d18c74de58-866a5dc4-49f8456a-b737b7e1-a7a91ad04bfbcc141b593427"><ac:plain-text-body><![CDATA[ | [[Sun 2006 | AA. References#Sun 06]] | Serialization Specification, A.4, Preventing Serialization of Sensitive Data | ]]></ac:plain-text-body></ac:structured-macro> |
...