SV.SERIAL.NOREADSV.SERIAL.NOREAD is reported for a class when this class directly or indirectly implements 'java.io.Serializable' interface but does not define method 'private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException'. Vulnerability and riskIf a class does not implement a 'readObject' method with the correct signature, the default serialization provided by 'defaultReadObject' will be used. Thus this class is not protected from deserialization, and an attacker can create a sequence of bytes that deserializes to an instance of your class. Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error. Mitigation and preventionImplement method 'private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException'. Example 1
5 public class SV_SERIAL_Sample_1 implements Serializable {
6
7 public static void main(String[] args)
8 {
9 System.out.println("Hello World!");
10 }
11 }
SV.SERIAL.NOREAD is reported for class 'SV_SERIAL_Sample_1' declaration on line 5. Related checkers |