BestHub
Sign in
Tagged articles

deserialization

65 articles · Page 1 of 1
Java Tech Workshop
Java Tech Workshop
Sep 3, 2026 · Backend Development

Why Adding a Method Breaks Java Deserialization: The Implicit serialVersionUID Trap

This article explains how Java's implicit serialVersionUID causes deserialization failures when class structure changes, details how the JVM calculates it, shows source-level version checking in ObjectStreamClass, lists compatible and incompatible changes, and covers custom serialization mechanisms like transient, writeObject/readObject, and Externalizable.

InvalidClassExceptionJVMJava
0 likes · 20 min read
Why Adding a Method Breaks Java Deserialization: The Implicit serialVersionUID Trap
Black & White Path
Black & White Path
Jul 16, 2026 · Information Security

Exploiting MySQL JDBC Deserialization: A Step‑by‑Step Analysis

The article walks through setting up a MySQL fake server, crafting a malicious JDBC URL with autoDeserialize and query interceptors, demonstrating how the MySQL JDBC driver automatically deserializes BLOB data via ObjectInputStream, and traces the call chain to show how arbitrary code can be executed during connection initialization.

JDBCMySQLSecurity
0 likes · 7 min read
Exploiting MySQL JDBC Deserialization: A Step‑by‑Step Analysis
JavaScript
JavaScript
Nov 16, 2025 · Frontend Development

Boost JavaScript Deserialization: Overcome JSON.parse Limits and Performance Bottlenecks

This article explains how JSON.parse and JSON.stringify work, outlines their performance, type, and security limitations, and presents practical strategies such as reviver functions, streaming parsers, binary formats, Web Workers, and incremental loading to achieve faster and safer JavaScript deserialization.

Binary FormatJSONJavaScript
0 likes · 6 min read
Boost JavaScript Deserialization: Overcome JSON.parse Limits and Performance Bottlenecks
DeWu Technology
DeWu Technology
Oct 15, 2025 · Backend Development

Unlock Fastjson: Inside Its High‑Performance Serialization Engine

This article dissects Alibaba's Fastjson library, explaining its architecture, core modules, project structure, serialization and deserialization processes, ASM‑based performance optimizations, AutoType security mechanisms, and streaming API, while providing code examples and practical insights for Java developers.

FastjsonJavadeserialization
0 likes · 29 min read
Unlock Fastjson: Inside Its High‑Performance Serialization Engine
JavaScript
JavaScript
Oct 13, 2025 · Frontend Development

When JSON.parse Slows You Down: Faster Deserialization Strategies

This article explains how JSON.parse and JSON.stringify work, outlines their performance, type, and security limitations, and presents advanced techniques such as reviver functions, streaming parsers, binary formats, Web Workers, and incremental loading to achieve faster and safer JavaScript deserialization.

JSONJavaScriptWeb Workers
0 likes · 6 min read
When JSON.parse Slows You Down: Faster Deserialization Strategies
Java Backend Technology
Java Backend Technology
Jul 7, 2025 · Backend Development

Master Dynamic JSON Fields in Java with @JsonAnyGetter and @JsonAnySetter

This article explains how Jackson's @JsonAnySetter and @JsonAnyGetter annotations let Java classes gracefully handle unknown JSON properties by collecting them into a map during deserialization and emitting them as regular fields during serialization, complete with practical code examples and usage tips.

DynamicPropertiesJSONJackson
0 likes · 7 min read
Master Dynamic JSON Fields in Java with @JsonAnyGetter and @JsonAnySetter
macrozheng
macrozheng
Jul 1, 2025 · Backend Development

Master Dynamic JSON Fields in Java with @JsonAnyGetter & @JsonAnySetter

This article explains how to handle JSON objects with unknown or changing fields in Java by using Jackson's @JsonAnySetter to collect them during deserialization and @JsonAnyGetter to serialize them back, complete with code examples, pitfalls, and a concise analogy.

DynamicPropertiesJSONJackson
0 likes · 8 min read
Master Dynamic JSON Fields in Java with @JsonAnyGetter & @JsonAnySetter
Test Development Learning Exchange
Test Development Learning Exchange
May 10, 2025 · Fundamentals

Using Python's json Module: Serialization, Deserialization, and Common Operations

This article introduces Python's built‑in json module, explaining how to serialize Python objects to JSON strings and files, deserialize JSON back to Python, and demonstrates common tasks such as pretty‑printing, handling Unicode, working with lists and nested structures, custom encoders, and network responses.

JSONPythondata handling
0 likes · 8 min read
Using Python's json Module: Serialization, Deserialization, and Common Operations
macrozheng
macrozheng
Apr 28, 2025 · Backend Development

Master Java Serialization: Common Pitfalls and Best Practices

This article explains the fundamentals of Java object serialization, compares legacy and modern formats, outlines how to choose the right method, and details common issues such as static fields, transient modifiers, serialVersionUID mismatches, inheritance quirks, and custom serialization techniques with clear code examples.

BackendExternalizableJava
0 likes · 15 min read
Master Java Serialization: Common Pitfalls and Best Practices
Test Development Learning Exchange
Test Development Learning Exchange
Mar 21, 2025 · Fundamentals

Understanding Python's pickle Module: Serialization and Deserialization

Python's pickle module provides a simple way to serialize and deserialize complex objects such as lists, dictionaries, and class instances, allowing them to be saved to or loaded from files or byte streams, with examples of pickling, unpickling, using dumps/loads, protocol versions, and security considerations.

Pickledata persistencedeserialization
0 likes · 4 min read
Understanding Python's pickle Module: Serialization and Deserialization
Java Tech Enthusiast
Java Tech Enthusiast
Dec 15, 2024 · Fundamentals

Java Serialization and Deserialization: Concepts and Practices

The article explains serialization and deserialization fundamentals, highlights pitfalls such as ambiguous binary streams and platform‑dependent field sizes, then compares Java’s native ObjectOutputStream, JSON libraries, Hessian binary RPC, and Google’s Protobuf, guiding readers to select the appropriate format based on performance, payload size, and type‑safety needs.

JSONJavaProtobuf
0 likes · 8 min read
Java Serialization and Deserialization: Concepts and Practices
Rare Earth Juejin Tech Community
Rare Earth Juejin Tech Community
Sep 24, 2024 · Mobile Development

Best Practices for JSON Serialization and Deserialization in Flutter Using json_serializable

This article explains the fundamentals of JSON serialization and deserialization in Flutter, compares manual and automated approaches, introduces the json_serializable library and its annotations, demonstrates generic handling, custom converters, and tooling to streamline model generation for robust mobile app development.

DartFlutterJSON
0 likes · 23 min read
Best Practices for JSON Serialization and Deserialization in Flutter Using json_serializable
Programmer1970
Programmer1970
Sep 20, 2024 · Backend Development

Master Jackson in Spring Boot: Essential Annotations and Extension Points

This article provides a comprehensive guide to Jackson’s most frequently used annotations, core modules, and extension points in Spring Boot, illustrating each feature with concrete Java code examples that show how to customize serialization, deserialization, property handling, and polymorphic type processing.

JSONJacksonJava
0 likes · 24 min read
Master Jackson in Spring Boot: Essential Annotations and Extension Points
Xuanwu Backend Tech Stack
Xuanwu Backend Tech Stack
Sep 8, 2024 · Backend Development

Master Java Serialization & Deserialization: Techniques, Pitfalls, and Security

This article explains Java serialization and deserialization concepts, outlines common use cases such as distributed systems and caching, compares multiple implementation methods including Serializable, Externalizable, JSON, XML, and binary libraries, and provides practical code examples, security tips, and best‑practice guidelines.

ExternalizableJSONJava
0 likes · 24 min read
Master Java Serialization & Deserialization: Techniques, Pitfalls, and Security
Spring Full-Stack Practical Cases
Spring Full-Stack Practical Cases
Aug 22, 2024 · Backend Development

Master Jackson Annotations in Spring Boot 3.2.5: From @JsonAnyGetter to Custom Annotations

This tutorial explores Jackson's rich annotation set in Spring Boot 3.2.5, demonstrating how to serialize and deserialize JSON with built‑in annotations like @JsonAnyGetter, @JsonGetter, @JsonPropertyOrder, and @JsonIgnore, how to create custom annotations, and how to disable annotation processing for fine‑grained control.

JSONJacksonSpring Boot
0 likes · 13 min read
Master Jackson Annotations in Spring Boot 3.2.5: From @JsonAnyGetter to Custom Annotations
Java Tech Enthusiast
Java Tech Enthusiast
Aug 14, 2024 · Backend Development

Customizing JSON Serialization and Deserialization in Spring Boot

In Spring Boot you can customize JSON request and response handling by annotating fields with @JsonSerialize/@JsonDeserialize, registering a global ObjectMapper module, adding a PropertyEditor via @ControllerAdvice, creating a custom HttpMessageConverter, or using AOP interception, selecting the approach that matches your project’s complexity.

AOPJSONJackson
0 likes · 7 min read
Customizing JSON Serialization and Deserialization in Spring Boot
Test Development Learning Exchange
Test Development Learning Exchange
Feb 19, 2024 · Backend Development

Using Python's json Module for Serialization, Deserialization, and API Testing

This article explains how to use Python's built‑in json module for serializing and deserializing data, demonstrates sending JSON payloads with the requests library, and covers advanced techniques such as data‑driven testing, JsonPath/JMESPath extraction, JSON Schema validation, and dynamic request body construction for API automation.

API-testingPythondeserialization
0 likes · 9 min read
Using Python's json Module for Serialization, Deserialization, and API Testing
Laravel Tech Community
Laravel Tech Community
Oct 29, 2023 · Information Security

Remote Code Execution Vulnerability in Apache ActiveMQ < 5.18.3 (Deserialization)

Apache ActiveMQ versions prior to 5.18.3 are vulnerable to a deserialization flaw that allows remote code execution via crafted OpenWire messages on port 61616, affecting various activemq-client and activemq-openwire-legacy artifacts, and can be mitigated by upgrading to 5.15.16, 5.16.7, 5.17.6, 5.18.3 or later.

Apache ActiveMQMessaging MiddlewareRemote Code Execution
0 likes · 3 min read
Remote Code Execution Vulnerability in Apache ActiveMQ < 5.18.3 (Deserialization)
AntTech
AntTech
Apr 19, 2023 · Information Security

ODDFuzz: Discovering Java Deserialization Vulnerabilities via Structure‑Aware Directed Greybox Fuzzing

The paper presents ODDFuzz, a structure‑aware directed greybox fuzzing framework that combines lightweight static taint analysis with targeted fuzzing to efficiently discover previously unknown Java deserialization (ODD) vulnerabilities, achieving higher recall and precision than existing tools and uncovering six new CVE‑rated bugs in popular Java frameworks.

FuzzingJavaODDFuzz
0 likes · 19 min read
ODDFuzz: Discovering Java Deserialization Vulnerabilities via Structure‑Aware Directed Greybox Fuzzing
Laravel Tech Community
Laravel Tech Community
Feb 15, 2023 · Information Security

ThinkPHP Deserialization Vulnerability (CVE-2022-45982)

The ThinkPHP framework suffers from a deserialization vulnerability (CVE‑2022‑45982) affecting versions 6.0.0‑6.0.13 and 6.1.0‑6.1.1, where unsanitized user input passed to unserialize() can allow attackers to execute arbitrary system commands, and no official patch has been released yet.

CVE-2022-45982PHPThinkPHP
0 likes · 2 min read
ThinkPHP Deserialization Vulnerability (CVE-2022-45982)
ByteFE
ByteFE
Aug 22, 2022 · Backend Development

Comparison of JDK, Fastjson, and Hessian Serialization Protocols and Practical Hessian Serialization

This article examines the reasons for using serialization, compares three serialization protocols (JDK built‑in, Fastjson, and Hessian) with performance metrics, and provides a detailed Hessian serialization implementation, including class definitions, test results, hex analysis, and troubleshooting of common issues.

Javadeserializationhessian
0 likes · 12 min read
Comparison of JDK, Fastjson, and Hessian Serialization Protocols and Practical Hessian Serialization
DaTaobao Tech
DaTaobao Tech
Jun 24, 2022 · Backend Development

Random Fastjson Deserialization Failure Caused by Constructor Order

The article explains that Fastjson sometimes throws a syntax‑error exception when deserializing a JSON list of StewardTipCategory objects because the JVM returns overloaded constructors in nondeterministic order, causing Fastjson to pick the wrong constructor; removing or renaming the ambiguous constructor fixes the issue.

BackendConstructorOrderFastjson
0 likes · 12 min read
Random Fastjson Deserialization Failure Caused by Constructor Order
Programmer DD
Programmer DD
Apr 22, 2022 · Backend Development

Master FastJSON 2.0: Maven Setup, Core APIs, and JSONPath Guide

This article introduces FastJSON 2.0, explains how to add the Maven dependency, outlines the main classes and methods for JSON, JSONB, and JSONPath, and provides code examples for serializing and deserializing Java objects as well as partial parsing with JSONPath.

JSONJSONPathJava
0 likes · 10 min read
Master FastJSON 2.0: Maven Setup, Core APIs, and JSONPath Guide
IT Services Circle
IT Services Circle
Mar 5, 2022 · Backend Development

Understanding Generic Type Erasure and Fastjson Deserialization with TypeReference in Java

This article explains how Java's generic type erasure affects Fastjson deserialization, demonstrates common mistakes, and shows the correct way to deserialize generic fields using Fastjson's TypeReference, while also revealing the inner workings of TypeReference through reflection and anonymous classes.

FastjsonTypeReferencedeserialization
0 likes · 9 min read
Understanding Generic Type Erasure and Fastjson Deserialization with TypeReference in Java
OPPO Amber Lab
OPPO Amber Lab
Dec 23, 2021 · Information Security

How Java Deserialization Vulnerabilities Enable Remote Code Execution

This article explains Java's reflection mechanism, details how deserialization flaws in libraries like Apache Commons Collections and Fastjson allow attackers to craft malicious objects that trigger arbitrary command execution, and provides practical proof‑of‑concept steps and mitigation recommendations.

FastjsonJavaSecurity
0 likes · 7 min read
How Java Deserialization Vulnerabilities Enable Remote Code Execution
Tencent Cloud Developer
Tencent Cloud Developer
Oct 11, 2021 · Backend Development

Comparison of Go JSON Parsing Libraries: Performance, Features, and Usage Guidelines

The article compares Go's built‑in encoding/json with third‑party libraries jsoniter, easyjson, jsonparser, and the author's jsonvalue, outlining each one's features, performance benchmarks, and ideal use cases—standard library for simplicity, easyjson for maximum speed with code generation, jsonparser or jsoniter for selective extraction, and jsonvalue for flexible, case‑insensitive handling.

BenchmarkJSONLibraries
0 likes · 21 min read
Comparison of Go JSON Parsing Libraries: Performance, Features, and Usage Guidelines
Programmer DD
Programmer DD
Aug 24, 2021 · Information Security

Fastjson RCE Chains: JdbcRowSetImpl, TemplatesImpl, and BasicDataSource Exploits

This article analyzes three Fastjson deserialization exploit chains—JdbcRowSetImpl, TemplatesImpl, and BasicDataSource—detailing how crafted JSON payloads trigger JNDI lookups, load remote malicious bytecode, and ultimately achieve remote code execution without requiring special Fastjson features.

FastjsonJNDIJava
0 likes · 13 min read
Fastjson RCE Chains: JdbcRowSetImpl, TemplatesImpl, and BasicDataSource Exploits
Full-Stack Internet Architecture
Full-Stack Internet Architecture
Apr 14, 2021 · Backend Development

Various Ways to Create Objects in Java: new, newInstance, Reflection, Cloning, and Deserialization

This article explains the multiple techniques for creating objects in Java—including the new operator, Class.newInstance, reflection with Constructor, cloning via Cloneable, and deserialization—while illustrating the underlying bytecode instructions and providing concrete code examples for each method.

JavaObject Creationbytecode
0 likes · 8 min read
Various Ways to Create Objects in Java: new, newInstance, Reflection, Cloning, and Deserialization
System Architect Go
System Architect Go
Mar 8, 2021 · Information Security

Insecure Deserialization

This article explains what insecure deserialization is, why it leads to high‑severity attacks, demonstrates typical PHP, Ruby, and Java examples, and provides practical techniques for identifying, exploiting, and mitigating unsafe deserialization vulnerabilities.

JavaPHPSecurity
0 likes · 27 min read
Insecure Deserialization
Programmer DD
Programmer DD
Oct 22, 2020 · Information Security

How Fastjson’s AutoType Bypass Enables File Read and SSRF Attacks

This article provides a detailed analysis of the recent Fastjson deserialization vulnerability, explaining how the autoType bypass can be exploited to achieve arbitrary file reads, SSRF, and other attacks by leveraging gadget classes such as AutoCloseable, and walks through the debugging process and code paths involved.

AutoTypeJavaSSRF
0 likes · 10 min read
How Fastjson’s AutoType Bypass Enables File Read and SSRF Attacks
Java Architecture Diary
Java Architecture Diary
Aug 27, 2020 · Information Security

How to Mitigate the Critical Jackson‑databind CVE‑2020‑24616 Vulnerability in Spring Boot

This article explains the high‑severity CVE‑2020‑24616 deserialization flaw in jackson‑databind, identifies affected Jackson and Spring Boot versions, and provides Maven‑based remediation steps such as version pinning, dependency exclusions, and dependencyManagement configuration to prevent remote code execution.

CVE-2020-24616JacksonSecurity
0 likes · 4 min read
How to Mitigate the Critical Jackson‑databind CVE‑2020‑24616 Vulnerability in Spring Boot
OPPO Amber Lab
OPPO Amber Lab
Jul 22, 2020 · Information Security

Understanding Web Security: Key Vulnerabilities and Penetration Testing Methods

This article explains the fundamentals of web security, outlines typical web architecture, classifies penetration testing approaches, enumerates common vulnerabilities such as SQL injection, XSS, file upload and deserialization, and discusses how attackers combine these flaws to launch advanced exploits.

Penetration TestingSQL injectionVulnerability Classification
0 likes · 7 min read
Understanding Web Security: Key Vulnerabilities and Penetration Testing Methods
Java Backend Technology
Java Backend Technology
Jul 16, 2020 · Information Security

How Java Deserialization Enables Remote Code Execution – Exploit Chains and Fixes

This article explains the mechanics of Java deserialization vulnerabilities, demonstrates how malicious payloads can trigger Runtime.exec via Commons‑Collections transformers and AnnotationInvocationHandler, showcases full exploit code, discusses Dubbo‑specific issues, and provides practical mitigation strategies.

Commons-CollectionsDubboJava
0 likes · 17 min read
How Java Deserialization Enables Remote Code Execution – Exploit Chains and Fixes
macrozheng
macrozheng
Jul 13, 2020 · Information Security

Why Fastjson’s AutoType Is a Security Nightmare—and How to Fix It

This article examines Fastjson’s AutoType feature, explains how its design leads to serious deserialization vulnerabilities across multiple versions, demonstrates exploit techniques using crafted @type payloads, and provides practical mitigation steps such as enabling safeMode and upgrading to the latest release.

AutoTypeFastjsonJava
0 likes · 17 min read
Why Fastjson’s AutoType Is a Security Nightmare—and How to Fix It
Programmer DD
Programmer DD
Jun 25, 2020 · Information Security

Critical Apache Dubbo RCE (CVE‑2020‑1948): Threat Details & Fixes

The 2020‑06‑23 security advisory reveals that Apache Dubbo versions 2.5.x, 2.6.0‑2.6.7, and 2.7.0‑2.7.6 contain a high‑severity deserialization vulnerability (CVE‑2020‑1948) allowing remote code execution, outlines its impact, provides affected version details, risk assessment, remediation steps, and references to mapping data and product‑level mitigation.

Apache DubboCVE-2020-1948Java
0 likes · 5 min read
Critical Apache Dubbo RCE (CVE‑2020‑1948): Threat Details & Fixes
Selected Java Interview Questions
Selected Java Interview Questions
May 13, 2020 · Fundamentals

Understanding Java Serialization and serialVersionUID: Concepts, Usage, and Common Pitfalls

This article explains Java serialization and deserialization, the role of the Serializable interface and serialVersionUID, demonstrates how to implement and test them with code examples, and discusses related features such as transient and static fields, providing practical insights for Java developers.

JavadeserializationserialVersionUID
0 likes · 11 min read
Understanding Java Serialization and serialVersionUID: Concepts, Usage, and Common Pitfalls
Programmer DD
Programmer DD
Nov 27, 2019 · Backend Development

Master Fastjson: Fast Java JSON Parsing and Serialization Guide

This article introduces JSON basics, explains the Fastjson library from Alibaba, outlines its key features, and provides practical Java code examples for parsing, serializing, and converting between JSON strings, objects, arrays, maps, lists, and beans using Fastjson’s API.

FastjsonJSONJava
0 likes · 6 min read
Master Fastjson: Fast Java JSON Parsing and Serialization Guide
Selected Java Interview Questions
Selected Java Interview Questions
Nov 12, 2019 · Backend Development

Understanding Java Serialization and Deserialization

This article explains what Java serialization and deserialization are, why they are needed for object persistence and distributed systems, and provides step‑by‑step code examples showing how to implement them using the Serializable interface and ObjectOutputStream.

BackendJavaObjectIO
0 likes · 6 min read
Understanding Java Serialization and Deserialization
Programmer DD
Programmer DD
Nov 8, 2019 · Information Security

How to Exploit Apache Commons FileUpload Deserialization: Payloads, Code Walkthrough, and Fixes

This article dissects the Apache Commons FileUpload DiskFileItem deserialization flaw, explains how readObject can be abused to write arbitrary files or directories depending on FileUpload and JDK versions, demonstrates payload construction with ysoserial, provides full Java code analysis, and outlines mitigation strategies.

Apache Commons FileUploadFile Upload VulnerabilityJava Security
0 likes · 9 min read
How to Exploit Apache Commons FileUpload Deserialization: Payloads, Code Walkthrough, and Fixes
Programmer DD
Programmer DD
Sep 12, 2019 · Backend Development

Master JSON Serialization in Java: A Deep Dive into Gson

This article walks through why developers should replace FastJson with Gson, explains Gson's core features, demonstrates basic and advanced serialization and deserialization—including handling arrays, collections, generic types, custom serializers, and annotations—while providing complete code examples and best‑practice tips.

GsonGsonBuilderJSON
0 likes · 20 min read
Master JSON Serialization in Java: A Deep Dive into Gson
JD Tech
JD Tech
Jan 21, 2019 · Information Security

Analysis of a PriorityQueue-Based Java Deserialization Gadget Using ysoserial

This article examines how a specially crafted PriorityQueue object, generated via the ysoserial tool, can be serialized and later trigger malicious code execution during Java deserialization, detailing the construction of the gadget, the transformation chain, and the underlying JVM mechanisms that enable the exploit.

GadgetPriorityQueuedeserialization
0 likes · 13 min read
Analysis of a PriorityQueue-Based Java Deserialization Gadget Using ysoserial
Java Captain
Java Captain
Sep 26, 2017 · Backend Development

Five Ways to Create Objects in Java and Their Bytecode

This article explains five Java object‑creation techniques—using the new keyword, Class.newInstance, Constructor.newInstance, clone, and deserialization—shows their bytecode differences, provides a complete Employee example, and demonstrates each method with runnable code and output.

Object Creationdeserializationreflection
0 likes · 8 min read
Five Ways to Create Objects in Java and Their Bytecode
Ctrip Technology
Ctrip Technology
Nov 1, 2016 · Information Security

Understanding Serialization, Deserialization Vulnerabilities and Mitigation in Java

The article explains Java serialization and deserialization concepts, provides sample code for serializing a string to a file and restoring it, describes how insecure deserialization leads to remote code execution vulnerabilities illustrated by ActiveMQ, JBoss and Jenkins cases, and outlines mitigation techniques such as class whitelisting, encryption, and using transient fields.

JavaSecurityVulnerability
0 likes · 7 min read
Understanding Serialization, Deserialization Vulnerabilities and Mitigation in Java
Meituan Technology Team
Meituan Technology Team
Mar 4, 2015 · Big Data

Serialization and Deserialization: Concepts, Protocols, and Selection Guidelines

The article explains serialization and deserialization fundamentals, compares key protocols (XML/SOAP, JSON, Thrift, Protobuf, Avro) across readability, performance, extensibility and security, presents benchmark results, and offers practical guidelines for choosing the most suitable format for various distributed system scenarios.

deserializationprotocolsserialization
0 likes · 26 min read
Serialization and Deserialization: Concepts, Protocols, and Selection Guidelines