Deserialization

Treat Deserialization as a Trust Boundary

Applications constantly turn bytes into useful values. A request body becomes a set of fields, a cached value becomes a record, or a message from a queue becomes a command. This conversion is called deserialization when the bytes represent a previously encoded data structure. The security problem begins when deserialization does more than recover inert data. Some serialization systems can reconstruct application-specific object types or trigger behavior while rebuilding an object graph. If an attacker can influence that serialized input, the parser may be asked to create types or invoke mechanisms that the application never intended to expose at that boundary.