I mean that fundamentally the deserializer has lookup function and it's going to lookup anything it's told to. You're right, some languages are worse about thi

I mean that fundamentally the deserializer has lookup function and it's going to lookup anything it's told to. You're right, some languages are worse about this, e.g. Python's pickle will perform arbitrary code executions. But it's easy enough to restrict it to a set of known good constructors. You still have the classic late-binding dilemma: it's flexibility we don't actually want. Why should my find_matching_socks function ever have to worry that it might be passed basketballs? The usual answer is, "it's fine, it'll just crash if they do that." It might crash, or it might hang, or silently corrupt something. An attacker can stick the wrong kind of object into your code anywhere they like.