> A similar issue has occurred with Java (and other languages, see https://frohoff.github.io/appseccali-marshalling-pickles/ https://frohoff.github.io/appseccal

> A similar issue has occurred with Java (and other languages, see https://frohoff.github.io/appseccali-marshalling-pickles/ https://frohoff.github.io/appseccali-marshalling-pickles/). Java provided a suberbly user-friendly way of serializing any object to disk and recovering it back in its original form. The only unfortunate problem was that there was no way to say which object you are expecting! This allows attackers to send you objects that, upon deserialization in your program, become nasties that wreak havoc and steal data. Not correct. You can certainly inspect before instantiation: https://docs.oracle.com/javase/7/docs/platform/serialization/spec/class.html https://docs.oracle.com/javase/7/docs/platform/serialization...