Serialization Security Risks and Alternatives

Java serialization is convenient, but it has a serious weakness: deserializing data from an untrusted source can be dangerous. During readObject, Java creates objects of whatever classes the bytes name and runs their special methods. An attacker who controls the bytes can chain together existing library classes, called gadgets, to run harmful code on the server. This has caused many real security incidents. In this lesson, you will learn the risks, how to reduce them with ObjectInputFilter, and why modern code prefers formats like JSON.

The Risks

Reducing the Risk: ObjectInputFilter

Java 9 added ObjectInputFilter, which checks every class and size limit before an object is created. A filter can be written as a pattern: allowed classes are listed, and !* rejects everything else.

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InvalidClassException;
import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.util.ArrayList;
 
public class FilterDemo {
    record Student(String name, int marks) implements Serializable { }
 
    static byte[] serialize(Object o) throws IOException {
        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
        try (ObjectOutputStream out = new ObjectOutputStream(bytes)) {
            out.writeObject(o);
        }
        return bytes.toByteArray();
    }
 
    static Object read(byte[] data) throws IOException, ClassNotFoundException {
        ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
            "FilterDemo$Student;java.lang.String;maxdepth=5;!*");
        try (ObjectInputStream in = new ObjectInputStream(
                new ByteArrayInputStream(data))) {
            in.setObjectInputFilter(filter);
            return in.readObject();
        }
    }
 
    public static void main(String[] args)
            throws IOException, ClassNotFoundException {
        Student s = new Student("Navika", 91);
        System.out.println("Allowed: " + read(serialize(s)));
        try {
            read(serialize(new ArrayList<>()));
        } catch (InvalidClassException e) {
            System.out.println("Rejected: " + e.getMessage());
        }
    }
}

Allowed: Student[name=Navika, marks=91]
Rejected: filter status: REJECTED

Explanation: The filter allows only the Student record and String, limits the graph depth to 5, and rejects everything else with !*. A Student passes. An ArrayList isn't on the list, so deserialization stops with InvalidClassException before the object is created. A JVM-wide filter can also be set with the jdk.serialFilter system property.

Alternatives to Java Serialization

A JSON library maps objects to text and back without running arbitrary code from the data. With Jackson, for example, writing and reading a record looks like this:

ObjectMapper mapper = new ObjectMapper();
String json = mapper.writeValueAsString(new Student("Navika", 91));
// {"name":"Navika","marks":91}
Student back = mapper.readValue(json, Student.class);

Jackson is an external library, so this snippet needs it on the classpath; build tools that add libraries are covered later in the course.

Common Mistakes

Accepting serialized objects in a web request, cookie or message queue. It's a classic attack entry point.

Relying on the cast after readObject for safety. The danger happens inside readObject, before the cast.

Serializing passwords and tokens. Mark them transient, or don't store them.

Interview Corner

Practice

1. Easy: Change the filter in FilterDemo to also allow java.util.ArrayList, and confirm that the list is now accepted.
2. Harder: Write a toCsv and fromCsv pair for a Student record using only String methods, as a simple alternative to Java serialization.

Key Takeaways