JAVA.SV.LLM.MODEL.DESERIAL

Unsafe deserialization of LLM output

The JAVA.SV.LLM.MODEL.DESERIAL checker identifies unsafe deserialization of LLM output.

Vulnerable code example

Copy
import org.springframework.ai.chat.client.ChatClient;
import org.springframework.ai.util.JsonHelper;

public class Example {
    public Object handle(ChatClient client, JsonHelper json) {
        String out = client.prompt().user("Return the config as JSON").call().content(); // untrusted LLM output
        return json.fromJson(out, Object.class); // deserialized into an object with no validation
    }
}

Fixed code example

Copy
import org.springframework.ai.util.JsonHelper;

public class Example {
    public Object handle(JsonHelper json) {
        String out = "{\"table\":\"users\"}"; // trusted/validated input, not raw model output
        return json.fromJson(out, Object.class);
    }
}