Serializable class in secure context
Reports classes that may be serialized or deserialized.
A class may be serialized if it supports the Serializable
interface, and its readObject()
and writeObject()
methods are not defined to always throw an exception. Serializable classes may be dangerous in code intended for secure use.
Example:
After the quick-fix is applied:
Locating this inspection
- By ID
Can be used to locate inspection in e.g. Qodana configuration files, where you can quickly enable or disable it, or adjust its settings.
SerializableDeserializableClassInSecureContext- Via Settings dialog
Path to the inspection settings via IntelliJ Platform IDE Settings dialog, when you need to adjust inspection settings directly from your IDE.
Use the following options to configure the inspection:
List classes whose inheritors should not be reported by this inspection. This is meant for classes that inherit
Serializable
from a superclass but are not intended for serialization. Note that it still may be more secure to addreadObject()
andwriteObject()
methods which always throw an exception, instead of ignoring those classes.Whether to ignore serializable anonymous classes.
Inspection options
Here you can find the description of settings available for the Serializable class in secure context inspection, and the reference of their default values.
- Ignore subclasses of
[java.awt.Component, java.lang.Throwable, java.lang.Enum]
- Ignore anonymous classes
Not selected
Availability
- By default bundled with
- Can be installed with plugin
Java, 241.18072