What are the security ramifications of using the Externalizable interface?
Location: http://www.jguru.com/faq/view.jsp?EID=2597 Created: Dec 14, 1999 Modified: 1999-12-22 23:58:13.386 Author: Govind Seshadri (http://www.jguru.com/guru/viewbio.jsp?EID=14) The methods within the Externalizable interface, readExternal() and writeExternal() have public scope. This implies some client object could potentially bypass the Java sandbox mechanisms and overwrite or gain access to the state of an externalizable object. As a general rule of thumb, a class should implement the Externalizable interface only if the object contains nonsensistive information.
Related Questions
- Why am I having an InvalidClassException thrown during the serialization of my object which implements the Externalizable interface?
- Through the application security interface, can our site limit access to application functions, etc., through RACF/ACF2/TOP SECRET?
- What are the security ramifications of using the Externalizable interface?
