JDK serialization filtering
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 92
- Forks
- 81
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 46
Description
Is your feature request related to a problem? Please describe.
Serialization is one of the biggest security problems in many programming languages, it isn’t just a JVM problem. Hackers can use tools designed to deliver a serialization exploit chain.
Describe the solution you'd like
The solution came in Java 9 in the form of serialization filtering as part of JEP 290. There are critical patch updates for older JDKs such as JDK 8u121.
Serialization filtering requires no code changes and we can enable it via global configuration or command line.
https://foojay.io/today/java-serialization-filtering-prevent-0-day-security-vulnerabilities/
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading JEP 290 and the linked serialization-filtering reference. Then inspect the repository's Java and runtime configuration to determine where this feature belongs; done should be a validated way to enable serialization filtering through supported global configuration or command-line settings without application code changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100