SV.SERIAL.NON

SV.SERIAL.NON occurs when a class implements a Serializable interface.

Vulnerability and risk

When an object is serialized, it is outside the control of the Java Runtime Environment, and therefore, outside control of the security provided by Java. Risk determined by organization policy.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Avoid implementing Serializable unless necessary. If you do implement Serializable, use transient for fields that contain handles to system resources or information relative to an address space.

Example 1

10
11
 public class SV_SERIAL_NON_Sample_1 implements Serializable {
 }

SV.SERIAL.NON is reported for class declaration on line 10: Class 'SV_SERIAL_NON_Sample_1' implements 'java.io.Serializable'.