Insecure Deserialization (ARCH8109)
Ce contenu n’est pas encore disponible dans votre langue.
Key kotlin.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502
Flags ObjectInputStream.readObject and other gadget-capable deserialisers used on untrusted data.
Incorrect
Section titled “Incorrect”val obj = ObjectInputStream(input).readObject()Correct
Section titled “Correct”val obj = json.decodeFromString<Payload>(input)Use a data-only format (JSON with an explicit schema) or an allowlisting ObjectInputFilter.