Safe Deserialization from ASVS framework

SAMMY UI is optimized for resolutions with a width 1024px and higher.

Encoding and Sanitization
Validation and Business Logic
Web Frontend Security
API and Web Service
File Handling
Authentication
Session Management
Authorization
Self-contained Tokens
- Token source and integrity
- Token content
OAuth and OIDC
Cryptography
Secure Communication
Configuration
Data Protection
Secure Coding and Architecture
Security Logging and Error Handling
WebRTC
- TURN Server
- Media
- Media

V1.5.1

V1.5.1: Verify that the application configures XML parsers to use a restrictive configuration and that unsafe features such as resolving external entities are disabled to prevent XML eXternal Entity (XXE) attacks.

V1.5.2

V1.5.2: Verify that deserialization of untrusted data enforces safe input handling, such as using an allowlist of object types or restricting client-defined object types, to prevent deserialization attacks. Deserialization mechanisms that are explicitly defined as insecure must not be used with untrusted input.

V1.5.3

V1.5.3: Verify that different parsers used in the application for the same data type (e.g., JSON parsers, XML parsers, URL parsers), perform parsing in a consistent way and use the same character encoding mechanism to avoid issues such as JSON Interoperability vulnerabilities or different URI or file parsing behavior being exploited in Remote File Inclusion (RFI) or Server-side Request Forgery (SSRF) attacks.