<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: preventing-insecure-deserialization
description: >-
  Identify and prevent insecure deserialization leading to RCE or object injection.
domain: cybersecurity
subdomain: secure-coding
tags:
  - deserialization
  - rce
  - object-injection
  - secure-coding
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Preventing Insecure Deserialization

## Overview

Identify and prevent insecure deserialization leading to RCE or object injection.

## Prerequisites

| Requirement | Install |
|---|---|
| Type-safe parsers | JSON Schema, Pydantic |
| Safety analysis | Dep audit |
| Python 3.10+ | For agent tooling |

## Key Concepts

Insecure deserialization of untrusted data enables RCE via
pickle/Java serialization, object injection, type confusion.
Use safe formats (JSON) and validate before deserializing.

## Quick Reference

```bash
# UNSAFE: pickle.loads(user_data)
# SAFE: json.loads(user_data)
node agent.js scan --directory src/ --check deserialization
node agent.js audit --file api.py --checks pickle,yaml,xml
```

## Workflow

1. Inventory deser points
2. Replace pickle with JSON
3. yaml.safe_load
4. Validate before deser
5. HMAC integrity
6. Static analysis
7. Add tests

## Detection

```yaml
title: Preventing Insecure Deserialization Detection
id: fbaaa167-1b2e-4745-abc4-96812e323971
status: experimental
description: Detects suspicious activity related to preventing insecure deserialization techniques in secure coding context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.initial_access
falsepositives:
  - Static analysis tools scanning source code repositories
```

## Verification

- No pickle on untrusted
- yaml.safe_load used
- JSON schema validation
- Integrity checks
- SAST catches patterns

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
