JAVA.SV.LLM.MODEL.DESERIAL
Unsafe deserialization of LLM output
The JAVA.SV.LLM.MODEL.DESERIAL checker identifies unsafe deserialization of LLM output.
Vulnerable code example
Copy
import org.springframework.ai.chat.client.ChatClient;
import org.springframework.ai.util.JsonHelper;
public class Example {
public Object handle(ChatClient client, JsonHelper json) {
String out = client.prompt().user("Return the config as JSON").call().content(); // untrusted LLM output
return json.fromJson(out, Object.class); // deserialized into an object with no validation
}
}
Fixed code example
Copy
import org.springframework.ai.util.JsonHelper;
public class Example {
public Object handle(JsonHelper json) {
String out = "{\"table\":\"users\"}"; // trusted/validated input, not raw model output
return json.fromJson(out, Object.class);
}
}
External guidance
Security training
Application security training materials provided by Secure Code Warrior.