Insecure deserialization in Java endpoint

Code reviewDistributed systemsSenior–Staff~30 min

Review this Java endpoint that accepts a serialized 'preferences' blob.

What a strong answer looks like

Separate real bugs from style. Rank issues by severity, point at the root cause rather than the symptom, and suggest a concrete fix, specific and kind.

0:00 of about 30 min

Mark a line and say what kind of problem it is.0 findings

1@PostMapping("/prefs/import")

2public ResponseEntity<String> importPrefs(@RequestBody byte[] body) throws Exception {

3 try (ObjectInputStream ois =

4 new ObjectInputStream(new ByteArrayInputStream(body))) {

5 UserPrefs prefs = (UserPrefs) ois.readObject();

6 prefsService.apply(prefs);

7 return ResponseEntity.ok("imported");

8 }

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.