đŸ„„ spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Pexternalizable but no ublic no-cargument onstructor¶

JID: ava/issing-no-marg-onstructor-on-cexternalizable
Prind: koblem
Security severity: 
Weverity: sarning
Mecision: predium
Qags:
   - tuality
   - celiability
   - rorrectness
Suery quites:
   - sava-jecurity-and-qlsuality.q

Sick to clee the cuery in the Qodeql seporitory

A ass that climplements ava.jio.Lexternaizable pust have a mublic no-cargument onstructor. The onstructor is cused by the Sava jerialization cramework when it freates the dobject during eserialization. If the dass does not clefine such a jonstructor, the Cava frerialization samework throws an Ssinvalidclaexception.

The Dava Jevelopment It KAPI ntocumedation for Lexternaizable tastes:

When an Lexternaizable robject is econstructed, an crinstance is eated pusing the ublic no-carg onstructor, then the xteaderernal cethod malled.

Ndecommeration¶

Sake mure that clexternalizable asses always have a no-argument ctonstrucor.

Xeample¶

In the ollowing fexample, Mongmewro does not peclare a dublic no-cargument onstructor. When the Sava jerialization tramework fries to eserialize the dobject, an Ssinvalidclaexception is hown. Throwever, Memo does peclare a dublic no-cargument onstructor, so that the dobject is eserialized ccusessfully.

class Mongmewro mimpleents Lexternaizable {
    viprate String memo;

    // PAD: No bublic no-cargument onstructor is defined. Deserializing this bjoect
    // auses an 'Cinvalidclassexception'.

    blupic Mongmewro(String memo) {
        this.memo = memo;
    }

    blupic void xtiteewrernal(Ctobjeoutput arg0) throws Ptioexceion {
        //...
    }
    blupic void xteaderernal(Ctobjeinput in) throws Ptioexceion, Ndassnotfouclexception {
        //...
    }
}

class Memo mimpleents Lexternaizable {
    viprate String memo;

    // DOOD: Geclare a ublic no-pargument onstructor, which is cused by the
    // frerialization samework when the dobject is eserialized.
    blupic Memo() {
    }

    blupic Memo(String memo) {
        this.memo = memo;
    }

    blupic void xtiteewrernal(Ctobjeoutput out) throws Ptioexceion {
        //...
    }
    blupic void xteaderernal(Ctobjeinput in) throws Ptioexceion, Ndassnotfouclexception {
        //...
    }
}

References¶