Web Security · Senior · Question 59 of 75

Why is unsafe deserialization dangerous?

1Because it makes JSON responses larger
✓Correct answer: Some formats can create arbitrary objects or call code during parsing, leading to remote code execution
3Because deserialized objects can't be logged

Explanation

Prefer data-only formats like JSON with schema validation. Avoid native object serialization of untrusted input.

Further reading

OWASP: Deserialization Cheat Sheet ↗

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.