deserialization-securitylisted

<!-- Native skill bundle for Claude Code. Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/deserialization-security/SKILL.md. --> # Deserialization Security Block unsafe deserialization across Java, Python, .NET, PHP, Ruby, Node.js — gadget chains, type allowlisting, safer alternatives ## ALWAYS - Prefer **structural, schema-validated** formats (JSON with a JSON Schema validator, Protobuf, FlatBuffers, MessagePack with an explicit type map) over polymorphic native serializers. The trade-off "save 10 lines of mapping code" is never worth the RCE primitive. - When a polymorphic deserializer is unavoidable, configure a **strict type allowlist** at the framework level (Jackson `PolymorphicTypeValidator`, fastjson safeMode, .NET `KnownTypeAttribute`, XStream `Whitelist`). The default of "any class" is the source of every modern Java deserialization CVE. - Sign and authenticate any cookie or token that carries serialized data with a fresh random key (HMAC-SHA-256, minimum). Never deserialize before HMAC verification. - Run deserialization code paths under the minimum capabilities the format needs (no filesystem, no network, no subprocess, no reflection) — e.g. Java `ObjectInputFilter` patterns; Python in a constrained namespace. - Treat any of the following functions as "untrusted-input deserialization primitives": Java `ObjectInputStream.readObject`, Jackson with `enableDefaultTyping`, SnakeYAML `Yaml.load()`, XStream `from