[NEW SKILL] insecure-deserialization-review

[JeremyZeng77]

Proposed Skill

Skill name: insecure-deserialization-review
Category: other
Severity: critical

What It Detects

Detects dangerous deserialization of untrusted data in languages and frameworks that allow object gadget execution, unexpected type materialization, or unsafe polymorphic binding.

Why This Skill Is Needed

The repo lacks a dedicated deserialization skill, yet this remains a high-impact class across web, API, and messaging systems. Existing secure-code-review guidance is too broad to drive specific tests or remediation here.

Detection Approach

Look for unsafe object deserializers, polymorphic type binding, trusted-by-default message queues, and missing allowlists for concrete types or schemas.

Languages / Frameworks

• java/spring
• python

Example Vulnerable Code

ObjectInputStream ois = new ObjectInputStream(req.getInputStream());
Object obj = ois.readObject();

Example Remediation

Use schema-bound JSON/protobuf parsing with explicit type allowlists and reject unexpected class metadata or polymorphic type hints.

References

• CWE-502
• OWASP Deserialization Cheat Sheet

Estimated Complexity

• Standard ($200) - Well-known vuln class, single language, straightforward detection
• Intermediate ($350) - Multiple languages/frameworks, nuanced detection logic
• Complex ($500) - Novel detection approach, comprehensive coverage, low FP rate

Bounty Info

• I have read and agree to the CONTRIBUTING.md bounty terms
• Preferred payment method: PayPal - https://paypal.me/Jeremytsangchina

[xiefuzheng713-alt]

/attempt #253

I will submit a focused new insecure-deserialization-review skill with Java/Python detection gates, vulnerable/benign fixtures, and index registration.

[xiefuzheng713-alt]

/claim #253

Submitted PR #2263: #2263

Scope: new insecure-deserialization-review AppSec skill covering Java ObjectInputStream, Python pickle-family loaders, unsafe YAML constructors, polymorphic type binding, side-effect hooks, integrity controls, and migration risks.

Validation completed:

• git diff --check
• git diff --cached --check
• required frontmatter check across skills/ and roles/
• index.yaml listed-file existence check
• prompt-injection pattern check equivalent to the repository workflow
• python -m py_compile for the new Python fixtures, with generated cache files removed before commit

No exploit payload, real credential, private key, token, cookie, seed phrase, or payment credential is included.