The CERT® Oracle® Secure Coding Standard for Java™

Chapter 15. Serialization (SER)

Rules

Risk Assessment Summary

SER00-J. Maintain serialization compatibility during class evolution

Once an object of a particular class has been serialized, future refactoring of the class’s code often becomes problematic. Specifically, existing serialized forms (encoded representations) become part of the object’s published API and must be supported for an indefinite period. This can be troublesome from a security perspective; not only does it promote dead code, it also forces the provider to maintain a compatible ...