Zennoxa Shield
Rules / Java
SHIELD-JAVA-004

Insecure Java Deserialization

criticalJavaCWE-502CVSS 9.8

What it detects

ObjectInputStream.readObject or readUnshared on untrusted data enables remote code execution.

How to fix

Avoid native serialization for untrusted data; use a safe format like JSON with strict type validation.

Vulnerable — Shield flags thisSessionStore.java
import java.io.*;

public class SessionStore {
    public Object restore(InputStream untrusted) throws IOException, ClassNotFoundException {
        try (ObjectInputStream in = new ObjectInputStream(untrusted)) {
            return in.readObject();
        }
    }
}
Fixed — scans cleanSessionStore.java
import com.fasterxml.jackson.databind.ObjectMapper;
import java.io.IOException;
import java.io.InputStream;

public class SessionStore {
    private static final ObjectMapper MAPPER = new ObjectMapper();

    public SessionData restore(InputStream untrusted) throws IOException {
        return MAPPER.readValue(untrusted, SessionData.class);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-004, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-004: Insecure Java Deserialization — Zennoxa Shield