no-unsafe-deserialization

Keywords: unsafe deserialization, CWE-502, RCE, code execution, YAML, pickle, security

CWE: CWE-693
OWASP Mobile: OWASP Mobile Top 10

Detects unsafe deserialization of untrusted data. This rule is part of eslint-plugin-secure-coding.

💼 This rule is set to error in the recommended config.

Quick Summary

Aspect	Details
CWE Reference	CWE-502 (Unsafe Deserialization)
Severity	Critical (CVSS 9.8)
Auto-Fix	💡 Suggestions available
Category	Security

Value & investment case

Why this rule pays for itself. Framework: cicd-impact/philosophy.md.

Dimension	Value
CWE	CWE-502 — Deserialization of Untrusted Data (CVSS 9.8 — Critical)
Feedback-loop tier	Editor / pre-commit (sub-second) — cheapest layer per the feedback-loop hierarchy
Defensive-layer leverage	~10× cheaper than unit-test · ~1,000× cheaper than production rollback · 10,000+× cheaper than disclosure — RCE-class vulnerability sits at the highest tier of the cost-ratio table (cost-ratio anchors)
Niche relevance	Critical: fintech, cybersecurity, infra/devtools (downstream RCE blast radius) · High: B2B SaaS, healthtech · Medium: B2C, marketplaces
Investor-frame impact	Insecure deserialization → Remote Code Execution (CVSS 9.8). One incident = full system compromise → mandatory disclosure → audit cycle restart → customer trust event. The single highest-leverage rule by counterfactual-value math: the catch costs ~$0; the unprevented bug costs the company.

Vulnerability and Risk

Vulnerability: Unsafe deserialization happens when an application accepts serialized objects from untrusted sources and deserializes them without validation.

Risk: Serialized data can contain malicious payloads that, upon deserialization, execute arbitrary code (Remote Code Execution - RCE), modify application logic, or cause Denial of Service (DoS). This is often considered one of the most critical security risks.

Rule Details

Unsafe deserialization occurs when untrusted data is deserialized in a way that allows attackers to execute arbitrary code or manipulate application logic. This includes:

Using eval() or Function() on untrusted data
YAML parsers that execute code
JSON with prototype pollution
Insecure serialization libraries

Why This Matters

Issue	Impact	Solution
💻 RCE	Full system compromise	Use safe deserializers
🎭 Object Manipulation	Logic bypass	Validate before deserializing
🔓 Auth Bypass	Unauthorized access	Use JSON.parse() for JSON data

Examples

❌ Incorrect

const func = new Function(req.body.input);

✅ Correct

// Use JSON.parse() for JSON data
const data = JSON.parse(userInput);

// YAML with safeLoad
import yaml from 'js-yaml';
const config = yaml.safeLoad(userYaml);
// Or with explicit safe schema
const config = yaml.load(userYaml, { schema: yaml.SAFE_SCHEMA });

// Validate before deserialization
if (isValidJson(userInput)) {
  const data = JSON.parse(userInput);
}

// Use safe serialization libraries
import { safeDeserialize } from 'safe-serialize';
const obj = safeDeserialize(userInput);

Configuration

{
  rules: {
    'secure-coding/no-unsafe-deserialization': ['error', {
      dangerousFunctions: ['eval', 'Function', 'serialize.unserialize'],
      safeLibraries: ['safe-serialize', 'json5'],
      validationFunctions: ['isValidJson', 'validateInput']
    }]
  }
}

Options

Option	Type	Default	Description
`dangerousFunctions`	`string[]`	`['eval', 'Function', 'unserialize']`	Dangerous deserialization functions
`safeLibraries`	`string[]`	`['safe-serialize']`	Safe deserialization libraries
`validationFunctions`	`string[]`	`['isValidJson', 'validateInput']`	Input validation functions

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-502 OWASP:A08 CVSS:9.8 | Deserialization of Untrusted Data detected | CRITICAL
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A08_2021/

Message Components

Component	Purpose	Example
Risk Standards	Security benchmarks	CWE-502 OWASP:A08 CVSS:9.8
Issue Description	Specific vulnerability	`Deserialization of Untrusted Data detected`
Severity & Compliance	Impact assessment	`CRITICAL`
Fix Instruction	Actionable remediation	`Follow the remediation steps below`
Technical Truth	Official reference	OWASP Top 10

Known False Negatives

The following patterns are not detected due to static analysis limitations:

Values from Variables

Why: Values stored in variables are not traced.

// ❌ NOT DETECTED - Value from variable
const value = userInput;
dangerousOperation(value);

Mitigation: Validate all user inputs.

Wrapper Functions

Why: Custom wrappers not recognized.

// ❌ NOT DETECTED - Wrapper
myWrapper(userInput); // Uses dangerous API internally

Mitigation: Apply rule to wrapper implementations.

Dynamic Invocation

Why: Dynamic calls not analyzed.

// ❌ NOT DETECTED - Dynamic
obj[method](userInput);

Mitigation: Avoid dynamic method invocation.