Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • Which easy to use alternatives are shipped with JDK? It is not just easy to use, it requires no dependencies. Commented Apr 18 at 11:02
  • 1
    I don't think this answer goes deep enough to show that a problem exists. A naive user would not expect what you described to be a problem unless they wrote some class with an obviously dangerous readObject method. An attacker can write a class with an evil readObject method, yes, but they can't make your program load that class, so it's safe. Unless you can trick a "safe" readObject method from the standard library into doing something bad - and the fact that is possible is the surprising part. Commented Apr 18 at 15:19
  • 1
    I do write "any serializable class available to your program" - so it's not just the standard library, but any library that you use. Commented Apr 19 at 6:44
  • 1
    @meriton Other libraries are the same way as the standard library - someone who doesn't know this is possible won't expect it to be possible, since they don't import evil libraries into their program. The fact that it's possible without an evil library is surprising. Commented Apr 19 at 12:59
  • 1
    The main justification for the risk is probably to load legacy data. Losing data is rarely acceptable, so you can just mitigate the problem as well as you can, and try to migrate the data to a newer format as soon as possible. Commented Apr 23 at 14:06