Java

JAVA.CLASS.SER.UIDM : Missing Serial Version Field (Java)

Summary

Missing or incorrect serialVersionUID in serializable class.

Serialization allows one to dump an object into a file and recover (deserialize) it later. For this to work, Java requires the class of the object to implement the java.io.Serializable interface. Moreover, all instance non-transient fields of the class must be serializable themselves. For inner non-static classes, also the outer class must be serializable. In order to distinguish dumps of objects for distinct versions of the same class, it is required that serializable classes define a static field containing the serial version of the class.

Properties

Class Name Missing Serial Version Field (Java)
Significance reliability
Mnemonic JAVA.CLASS.SER.UIDM
Categories
CWE CWE:913 Improper Control of Dynamically-Managed Code Resources
  CWE:1076 Insufficient Adherence to Expected Conventions
CERT-Java CERT-Java:SER00-J Enable serialization compatibility during class evolution
Availability Available for Java only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file. 
WARNING_FILTER += discard class="Missing Serial Version Field (Java)"

Example 

// SerializationTest.java
import java.io.Serializable;

public class SerializationTest implements Serializable {
  private static final long serialVersionUID = -8282042466563875052L;
  private final Object f;                       /* Nonserializable Field (Java) warning issued here:
                                                 * f can hold any Object, including an Object that is not serializable.
                                                 */ 
  private final C.Inner inner;
        
  public SerializationTest(Object f) {
    this.f = f;
    this.inner = new C().new Inner();
  }
}

// C.java
import java.io.Serializable;

class C {
  public class Inner implements Serializable {} /* Warnings of two classes issued here:
                                                 * - Missing Serial Version Field (Java)
                                                 * - Nonserializable Outer Class (Java)
                                                 */ 
}

In this example, the programmer should add the missing serialVersionUID field, make the inner class static and restrict the possible values for field SerializationTest.f, as follows:

// SerializationTest.java, after modification
import java.io.Serializable;

public class SerializationTest implements Serializable {
  private static final long serialVersionUID = -8282042466563875052L;
  private final Object f;
  private final C.Inner inner;
        
  public SerializationTest(Serializable f) {
    this.f = f;
    this.inner = new C.Inner();
  }
}

// C.java, after modification
import java.io.Serializable;

class C {
  public static class Inner implements Serializable {
    private static final long serialVersionUID = 7979349187288425675L;
  }
}

Resolution

Guarantee that all instance non-transient fields of a serializable class are themselves serializable. Make inner serializable classes have a serializable outer class, or make them static. Add a long serialVersionUID field to serializable classes.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.