Deserialization of Untrusted Data

Serialization is a common technique for converting complex objects into a storable or transmittable format, like JSON or binary streams. The danger arises when an application blindly trusts this serialized data from external sources—such as user inputs, cookies, or network packets—and reconstructs (deserializes) it back into live objects. Without strict controls, an attacker can craft malicious payloads that, when deserialized, trigger dangerous actions like remote code execution, file system access, or denial-of-service attacks. To prevent this, developers should treat all serialized data from outside the application's trust boundary as inherently hostile. Effective defenses include using safe, data-only serialization formats (like plain JSON without code execution features), implementing integrity checks with digital signatures, employing strict type constraints during deserialization, and utilizing security tools that monitor and validate deserialization processes. Never rely on obscurity or client-side checks, as attackers can easily bypass them.