Deserialization

// Java/Spring Boot - SECURE against deserialization attacks

import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.web.bind.annotation.*;

@RestController
public class ImportController {
    
    private final ObjectMapper objectMapper = new ObjectMapper();
    
    @PostMapping("/api/import-data")
    public ResponseEntity<?> importData(@RequestBody String jsonBody) {
        try {
            // SECURE: Use JSON instead of Java serialization
            // Jackson ObjectMapper only deserializes to the specified type
            // No arbitrary code execution during deserialization
            UserData data = objectMapper.readValue(jsonBody, UserData.class);
            
            // Validate the data
            if (data.getName() == null || data.getName().isEmpty()) {
                return ResponseEntity.badRequest().body("Invalid data");
            }
            
            // Process safely deserialized data
            return ResponseEntity.ok("Imported: " + data.getName());
        } catch (Exception e) {
            return ResponseEntity.status(400).body("Invalid JSON");
        }
    }
}

// Define explicit DTOs - no generic Object deserialization
public class UserData {
    private String name;
    private String email;
    
    // Getters and setters
    public String getName() { return name; }
    public void setName(String name) { this.name = name; }
    public String getEmail() { return email; }
    public void setEmail(String email) { this.email = email; }
}

// Python/Flask - SECURE
import yaml
import json
from flask import Flask, request

app = Flask(__name__)

@app.route('/api/import-config', methods=['POST'])
def import_config():
    config_data = request.data
    
    # SECURE: Use safe_load instead of load
    # safe_load only constructs simple Python objects (dict, list, str, etc.)
    # No arbitrary Python object construction
    try:
        config = yaml.safe_load(config_data)
        
        # Validate the structure
        if not isinstance(config, dict):
            return {'error': 'Invalid config format'}, 400
        
        return {'status': 'imported', 'config': config}
    except yaml.YAMLError as e:
        return {'error': 'Invalid YAML'}, 400

# ALTERNATIVE: Use JSON instead of YAML
@app.route('/api/import-config-json', methods=['POST'])
def import_config_json():
    # SECURE: JSON only deserializes to basic types
    try:
        config = request.get_json()
        return {'status': 'imported', 'config': config}
    except Exception as e:
        return {'error': 'Invalid JSON'}, 400

# For session data, use signed cookies or JWT instead of pickle
from itsdangerous import URLSafeTimedSerializer

serializer = URLSafeTimedSerializer('secret-key')

@app.route('/api/create-session', methods=['POST'])
def create_session():
    # SECURE: Use signed serialization instead of pickle
    session_data = {'user_id': 123, 'role': 'user'}
    token = serializer.dumps(session_data)
    return {'token': token}

@app.route('/api/restore-session', methods=['POST'])
def restore_session():
    token = request.json.get('token')
    
    # SECURE: Verify signature and deserialize safely
    try:
        session_data = serializer.loads(token, max_age=3600)
        return {'session': session_data}
    except Exception as e:
        return {'error': 'Invalid or expired token'}, 401