Skip to main content

Avoid deserializing untrusted data

Summary

The system must not deserialize untrusted data before applying the appropriate integrity checks.

Description

Serialization is the process of transforming an object into a stream of bytes to store or transmit it. This allows saving its state, so that it can be recovered later using deserialization. If an object comes from an untrusted source and is not properly validated before being deserialized, it can lead to deserialization attacks such as object injection.

Supported In

This requirement is verified in following services:

PlanSupported
Machine🟢
Squad🟢
One-Shot🟢

References

Vulnerabilities