Non-Serializable Write Object Argument
ID |
java.writeobject_arg_implement_serializable |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
CWE:594, reliability |
Description
Reports a call to ObjectOutputStream.writeObject(arg) whose argument’s type is known not to implement java.io.Serializable.
"Known not to" is meant strictly. An enum argument is never reported — java.lang.Enum implements Serializable. Neither is a type whose supertype chain leaves the scanned sources, a library class the analysis cannot see: a graph missing edges is unknown, not a proof that no path to Serializable exists.
Rationale
ObjectOutputStream.writeObject(Object) accepts any Object, so the compiler cannot catch a non-serializable argument. The mistake only surfaces at runtime, as a NotSerializableException naming the offending class — often far from the call site that passed it in, and only once that code path actually runs.
class ConnectionHandle {
// does not implement Serializable
}
void persist(ObjectOutputStream out, ConnectionHandle handle) throws IOException {
out.writeObject(handle); // Bad -- throws NotSerializableException
}Remediation
Make the type implement Serializable (and give every non-serializable field of it either a serializable replacement or the transient modifier), or write out a serializable snapshot of its state instead of the object itself.
class ConnectionSnapshot implements Serializable {
private final String endpoint;
ConnectionSnapshot(String endpoint) {
this.endpoint = endpoint;
}
}
void persist(ObjectOutputStream out, ConnectionSnapshot snapshot) throws IOException {
out.writeObject(snapshot); // Good
}