Externalizable class missing public no-arg constructor

ID

java.externalizable_must_have_no_arg_constructor

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Java

Tags

CWE:1066, reliability

Description

Reports classes implementing java.io.Externalizable that do not declare a public no-arg constructor.

Rationale

Unlike Serializable, the Externalizable contract requires a public no-arg constructor because the JVM uses it to instantiate the object before calling readExternal(). If the class only has constructors with parameters, or if the no-arg constructor is not public, deserialization fails at runtime with an InvalidClassException.

// Bad - no public no-arg constructor
public class Config implements Externalizable {
    private Config(String path) { ... }

    @Override public void writeExternal(ObjectOutput out) { ... }
    @Override public void readExternal(ObjectInput in) { ... }
}

Remediation

Add a public no-arg constructor to the class.

// Good
public class Config implements Externalizable {
    public Config() {}
    public Config(String path) { ... }

    @Override public void writeExternal(ObjectOutput out) { ... }
    @Override public void readExternal(ObjectInput in) { ... }
}

References