Unsafe Polymorphic Deserialization or Permissive Boundary Decoding

Remediation checklist

• Go & Rust: call dec.DisallowUnknownFields() on boundary encoding/json.Decoder instances in Go and annotate boundary request structs with #[serde(deny_unknown_fields)] plus bounded bincode options in Rust.
• TypeScript & JavaScript: replace node-serialize / unsafe js-yaml schemas with JSON.parse + strict schema validation (e.g. zod.strict()) or FAILSAFE_SCHEMA; Python: replace pickle.loads and unsafe yaml.load with yaml.safe_load(data) or typed JSON models.
• Java & Kotlin: enforce strict allowlist ObjectInputFilter before ObjectInputStream.readObject() or use typed Jackson/kotlinx.serialization without polymorphic default typing; C#: replace BinaryFormatter and TypeNameHandling.All with System.Text.Json typed DTOs.
• C/C++: decode untrusted bytes with length-validated schema parsers (Protobuf/FlatBuffers) rather than raw struct casts; Ruby: replace Marshal.load, YAML.unsafe_load, and permissive Oj.load with YAML.safe_load(data, permitted_classes: []) or Oj.load(data, mode: :strict); PHP: pass ['allowed_classes' => false] to unserialize() or use json_decode(); Swift: enforce NSSecureCoding via NSKeyedUnarchiver.unarchivedObject(ofClass:from:) or typed Codable.

Illustrative Code Examples

These fragments explain migration direction. They are not complete applications or compiler-verified patches for your project.

// Go: permissive boundary JSON decoder accepts unknown fields
err := json.NewDecoder(r.Body).Decode(&dst)

# Ruby: arbitrary object gadget instantiation
session = Marshal.load(raw_cookie)

// PHP: POP-chain object injection via unserialize
$prefs = unserialize($_COOKIE['prefs']);

// Go: bounded + DisallowUnknownFields
dec := json.NewDecoder(http.MaxBytesReader(w, r.Body, 1<<20))
dec.DisallowUnknownFields()
err := dec.Decode(&dst)

# Ruby: safe_load with zero custom classes permitted
session = YAML.safe_load(raw_cookie, permitted_classes: [], aliases: false)

// PHP: object instantiation explicitly disabled
$prefs = unserialize($_COOKIE['prefs'], ['allowed_classes' => false]);