Serialization, Deserialization and Parser Security — DedSec Project

Learn why data reconstruction is a high-value security boundary. Compare schema-driven formats, object serialization, polymorphic types, parser differentials and safe validation patterns.

Learning objectives

By the end of this module you should be able to:

• Explain serialization versus object graphs and identify its most important trust boundary, state transition, and evidence source.
• Explain schema validation and canonical forms and identify its most important trust boundary, state transition, and evidence source.
• Explain JSON, XML, YAML and binary formats and identify its most important trust boundary, state transition, and evidence source.
• Explain polymorphic type handling and identify its most important trust boundary, state transition, and evidence source.
• Explain unsafe object reconstruction and identify its most important trust boundary, state transition, and evidence source.
• Explain parser differentials and duplicate fields and identify its most important trust boundary, state transition, and evidence source.

Deep concepts

1. serialization and object graphs

Serialization converts structured in-memory state into a transport/storage representation; deserialization reconstructs data from untrusted bytes. Keep the wire schema simpler than internal object graphs so external input cannot select arbitrary application types or constructors.

2. schemas and canonical forms

Explicit schemas define field types, ranges, required values, and compatibility rules. Canonical representation matters when data is signed, hashed, cached, or compared: two encodings with the same apparent meaning should not produce contradictory security decisions.

3. JSON, XML, YAML and binary formats

Each format has different parser behavior, type systems, references, extensions, and resource risks. Disable unnecessary features, bound nesting/size, select maintained parsers, and test duplicate or ambiguous fields at service boundaries.

4. polymorphic types

Automatic polymorphic deserialization can let input choose which class/type is instantiated. Prefer explicit discriminators mapped to a narrow allowlist of data-only types, followed by separate application logic that performs authorized actions.

5. unsafe reconstruction

Deserialization should not invoke arbitrary constructors, setters, hooks, or object-resolution behaviors with attacker-controlled state. Treat reconstruction as parsing: produce inert data, validate it, then perform side effects only through normal authorized code paths.

6. parser differentials and duplicate fields

Proxies, validators, signature layers, and application parsers can handle duplicate keys, numeric forms, encodings, or unknown fields differently. Regression-test the same serialized bytes through every layer that makes a security decision.

7. resource exhaustion

Deep nesting, huge collections, decompression, entity expansion, or pathological inputs can consume CPU/memory before business validation runs. Apply input-size, depth, object-count, recursion, and processing-time limits at the earliest trusted boundary.

8. safe deserialization patterns

Use explicit schemas, data-only representations, allowlisted types, bounded resources, authenticated transport/storage where required, and version-aware migrations. Preserve parser/version evidence so a future library change can be regression-tested against security-critical samples.

Authorized lab sequence

• Lab 1 — Create a toy JSON schema and test missing, duplicated, oversized and wrong-type fields locally.

• Lab 2 — Compare how two safe parsers represent duplicate keys using synthetic data and document the trust implication.

• Lab 3 — Refactor a fictional “deserialize directly into privileged object” design into explicit validated data transfer objects.

Knowledge checks

Answer these without looking at the notes:

Next modules

Recommended related modules: 014, 022, 040, 068, 069, 071, 108. From the main menu, choose Search lessons to find related sections across the full guide.