hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Clarify that deserialization that follows a schema is safe

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-05-07 10:51:20 +01:00
parent 7aa3fd859a
commit 427b73ec9d
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.qhelp
View File

@@ -18,6 +18,14 @@ supports Kryo, XmlDecoder, XStream, SnakeYaml, JYaml, JsonIO, YAMLBeans, Hessian
Jackson, Jabsorb, Jodd JSON, Flexjson, Gson, JMS, and Java IO serialization through
<code>ObjectInputStream</code>/<code>ObjectOutputStream</code>.
</p>
<p>
Note that a deserialization method is only dangerous if it can instantiate
arbitrary classes. Serialization frameworks that use a schema to instantiate
only expected, predefined types are generally safe and are not tracked by this
query. For example, Apache Avro's deserialization methods follow a schema and
therefore cannot instantiate arbitrary classes, making them safe to use even
with untrusted data.
</p>
</overview>
<recommendation>