OWASPASVS 5.0 requirement
ASVS-V1.5.2 Deserialization of untrusted data enforces safe input handling, such as using an allowlist of object types or restricting client-defined…
- Standard
- OWASP ASVS 5.0
- Chapter
- V1 Encoding and Sanitization
- Section
- V1.5 Safe Deserialization
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that deserialization of untrusted data enforces safe input handling, such as using an allowlist of object types or restricting client-defined object types, to prevent deserialization attacks. Deserialization mechanisms that are explicitly defined as insecure must not be used with untrusted input.