Java

JAVA.CLASS.SER.DESER : Deserializable Class (Java)

Summary

A class implements Serializable, which may allow adversaries to artificially forge objects from a byte array. This can be a security hazard since there is no control on the state of the new object.

Properties

Class Name Deserializable Class (Java)
Significance security
Mnemonic JAVA.CLASS.SER.DESER
Categories
CWE CWE:502 Deserialization of Untrusted Data
  CWE:913 Improper Control of Dynamically-Managed Code Resources
OWASP-2017 OWASP-2017:A8 Insecure deserialization
OWASP-2021 OWASP-2021:A8 Software and data integrity failures
Availability Available for Java only.
Enabling Checks for this warning class are disabled by default. To enable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += allow class="Deserializable Class (Java)"

Example 

// C.java
import java.io.Serializable;

public class C implements Serializable {    /* Deserializable Class (Java) warning issued here
                                             * C is explicitly serializable. 
                                             */ 
  private static final long serialVersionUID = 6045080196558799656L;
}

// D.java
public class D {}                           /* Deserializing Non-Serializable Class (Java) warning issued here
                                             * D is not explicitly serializable but does not implement a readObject() method. 
                                             */ 

// B.java
import java.io.ObjectInputStream;

public class B {                                                       // ok: not explicitly serializable, and implements readObject() method (which always throws an exception) 
  private void readObject(ObjectInputStream stream) {
        throw new RuntimeException("Deserialization is not allowed");
  }
}

In this example, the programmer should: 

import java.io.Serializable;

public class C {
  private void readObject(ObjectInputStream stream) {
      throw new RuntimeException("Deserialization is not allowed");
  }
}

public class D {
  private void readObject(ObjectInputStream stream) {
      throw new RuntimeException("Deserialization is not allowed");
  }
}

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.