Software & Data Integrity Failures: Insecure deserialization and Subresource Integrity (SRI).

Insecure Deserialization

Deserialization is the process of restoring structured objects from a stream of bytes or JSON strings. In dynamic languages (Python, JavaScript, Java), native deserialization engines can instantiate arbitrary classes and execute code.

Python Vulnerability (pickle):
import pickle
# NEVER unpickle untrusted data! pickle can instantiate os.system!
pickle.loads(untrusted_user_input) # Remote Code Execution (RCE)!

Node.js Vulnerability (node-serialize):
const serialize = require('node-serialize');
// An object with an Immediately Invoked Function Expression (IIFE) "_$$ND_FUNC$$_"
// executes arbitrary shell commands upon unserialization!
serialize.unserialize(untrusted_payload);

Secure Deserialization Standards

• Use pure data serialization formats (JSON, Protocol Buffers, FlatBuffers) that contain pure schema-driven values without executable code.
• If complex binary objects must be transmitted, cryptographically sign the payload with HMAC-SHA256 and verify the signature before deserializing.