Zennoxa Shield
Rules / Java
SHIELD-JAVA-005

Insecure Deserialization via XMLDecoder

criticalJavaCWE-502CVSS 9.8

What it detects

XMLDecoder deserializes arbitrary objects and can execute attacker-supplied code.

How to fix

Do not use XMLDecoder on untrusted input; use a safe data-binding library with restricted types.

Vulnerable — Shield flags thisConfigLoader.java
import java.beans.XMLDecoder;
import java.io.BufferedInputStream;
import java.io.InputStream;

public class ConfigLoader {
    // XMLDecoder instantiates arbitrary classes described by the incoming XML.
    public XMLDecoder openDecoder(InputStream untrusted) {
        return new XMLDecoder(new BufferedInputStream(untrusted));
    }
}
Fixed — scans cleanConfigLoader.java
import com.fasterxml.jackson.dataformat.xml.XmlMapper;
import java.io.IOException;
import java.io.InputStream;

public class ConfigLoader {
    private static final XmlMapper XML = new XmlMapper();

    public AppConfig load(InputStream in) throws IOException {
        return XML.readValue(in, AppConfig.class);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JAVA-005, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JAVA-005: Insecure Deserialization via XMLDecoder — Zennoxa Shield