Solutions Library

Java detectors (12/12)

Deserialization of untrusted object

Deserialization of untrusted object

High
Deserialization of untrusted or potentially malformed data can be exploited for denial of service or to induce running untrusted code.
Detector ID
java/untrusted-deserialization@v1.0
Category
Security
Tags
  • injection
  • owasp-top10
  • top25-cwes
Common Weakness Enumeration (CWE) 

Noncompliant example

public List ObjectMapperNoncompliant(final File input) throws Exception {
    final ObjectMapper mapper = new ObjectMapper();
    // Noncompliant: enabling default typing can introduce a remote code execution vulnerability.
    mapper.enableDefaultTyping();
    return mapper.readValue(input, List.class);
}

Compliant example

public List ObjectMapperCompliant(final File input) throws Exception {
    final ObjectMapper mapper = new ObjectMapper();
    // Compliant: disabling default typing prevents the vulnerability.
    mapper.deactivateDefaultTyping();
    return mapper.readValue(input, List.class);
}