Unsanitized user input in deserialization method

Description

It is bad practice to deserialize untrusted data, such as data that comes from params or cookies, without sufficient verification. Attackers can transfer payloads or malicious code via serialized data, and deserializing such data puts your application at risk.

Remediations

  • Do not deserialize data from untrusted sources directly. This includes data received through user input, parameters, or cookies.
  • Do not use XMLEncoder and XMLDecoder for serialization and deserialization. These classes are not secure and can increase the risk of attacks.
  • Do use data-only and language-agnostic serialization formats like JSON. These formats are less susceptible to manipulation by attackers aiming to exploit the deserialization process.
  • Do use deserialization methods that allow you to define explicitly which object types are permitted for deserialization. This helps prevent the deserialization of potentially harmful objects.
  • Do not allow the deserialization of generic base object types, such as Object. Restricting the types of objects that can be deserialized minimizes the risk of executing malicious code.

References

Associated CWE

OWASP Top 10

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=java_lang_deserialization_of_user_input

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=java_lang_deserialization_of_user_input