SEC021
Insecure deserialization
Object Pascal — Delphi & Free Pascal
Warning
Security
Deserializing untrusted streams can instantiate arbitrary classes and execute code
deserializing untrusted streams can instantiate arbitrary classes and execute code.
Why this severity
deserializing untrusted streams can instantiate arbitrary classes and execute code.
Known false positives
deserialization of application-owned resource files compiled into the binary.
Remediation example
if IsValidStream(Stream) then Component := Stream.ReadComponent(nil);