Page History

SER08 SER07-J

medium

probable

high

P4

L3

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2c119ff6e13374db-a708855b-43994b03-9265af9a-859377865b43d00d024fff94"><ac:plain-text-body><![CDATA[

[[MITRE 2009

AA. Bibliography#MITRE 09]]

[CWE ID 502

http://cwe.mitre.org/data/definitions/502.html] "Deserialization of Untrusted Data"

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2efd0c4f2c63d53c-df9e0807-4a664389-8be7af59-fe014940a09fbae278df5ebb"><ac:plain-text-body><![CDATA[

[[API 2006

AA. Bibliography#API 06]]

Class Object, Class Hashtable

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="2c7a8b0704a316fc-2c0688a8-4b124b31-9c829c69-5144b5026eb7818acc48965b"><ac:plain-text-body><![CDATA[

[[Bloch 2008

AA. Bibliography#Bloch 08]]

Item 75: "Consider using a custom serialized form"

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5d8a79615446c44d-111bb0f0-4f664f46-95318065-10ce1dc8bfd9f4eb7ab9d206"><ac:plain-text-body><![CDATA[

[[Greanier 2000

AA. Bibliography#Greanier 00]]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="08bb0cc130ae221e-ed009aca-4b1a4aea-bacf96a8-4d429e903ce793c2de4dfb1e"><ac:plain-text-body><![CDATA[

[[Harold 1999

AA. Bibliography#Harold 99]]

Chapter 11: Object Serialization, Validation

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c2721d014b3b07a9-efb4a397-4431433b-a2c69f0f-d80d828c03db262e87f39e92"><ac:plain-text-body><![CDATA[

[[Hawtin 2008

AA. Bibliography#Hawtin 08]]

Antipattern 8: Believing deserialisation is unrelated to construction

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="49e1348b9b0a2804-e67cd2dc-470b4638-b46ea09a-99070f15bd4c46919e22a13f"><ac:plain-text-body><![CDATA[

[[SCG 2007

AA. Bibliography#SCG 07]]

Guideline 5-2 View deserialization the same as object construction

]]></ac:plain-text-body></ac:structured-macro>