https://nalar.dev/tags/deserialization/ Recent content in Deserialization on Nalar Hugo en-us Fri, 04 Sep 2026 00:00:00 +0700 https://nalar.dev/treat-deserialization-as-a-trust-boundary/ Fri, 04 Sep 2026 00:00:00 +0700 https://nalar.dev/treat-deserialization-as-a-trust-boundary/ <p>Applications constantly turn bytes into useful values. A request body becomes a set of fields, a cached value becomes a record, or a message from a queue becomes a command. This conversion is called <strong>deserialization</strong> when the bytes represent a previously encoded data structure.</p> <p>The security problem begins when deserialization does more than recover inert data. Some serialization systems can reconstruct application-specific object types or trigger behavior while rebuilding an object graph. If an attacker can influence that serialized input, the parser may be asked to create types or invoke mechanisms that the application never intended to expose at that boundary.</p>