Mine deserialization sinks (ObjectInputStream, XMLDecoder, XStream, SnakeYAML) that may deserialize untrusted data (javasecurity:S5135); read-only metrics for security review
Read-only mining codemod for SonarSource rule javasecurity:S5135 — Deserialization should not be vulnerable to injection attacks.
It scans Java source and emits metrics only; it never modifies code (return null).
Findings are high-signal review candidates surfaced by AST pattern matching — they are not proven vulnerabilities. A static mining pass cannot prove an end-to-end taint flow
from an untrusted source to the sink, so confirm data flow before remediating.
Field
Value
Rule key
javasecurity:S5135
Type
Vulnerability
Severity
Blocker
Primary CWE
CWE-502 (Deserialization of Untrusted Data)
Tags
cwe
What it detects
Unsafe deserialization sinks that may process untrusted data.
Sinks:
new ObjectInputStream(...) + readObject / readUnshared
new XMLDecoder(...)
XStream.fromXML(...)
SnakeYAML Yaml.load / loadAs / loadAll
Emission rule: Emits on sink presence (deserialization sinks are risky regardless of the immediate argument shape).
Metric: java-deserialization-injection-mining
dimension
meaning
rule
SonarSource rule key
cwe
primary CWE identifier
severity
always blocker
sink
the detected sink (method/constructor)
package_name
enclosing Java package
class_name
enclosing class/interface/enum/record
method_name
enclosing method/constructor (or <none>)
file
file path (relative to scan target)
line
1-based line of the finding
arg_kind
classification of the relevant argument (literal, concatenation, variable, method_call, field, object_creation, expression, none)
Security standards
CWE-20 (Improper Input Validation)
CWE-502 (Deserialization of Untrusted Data)
OWASP ASVS 4.0: 1.5.2, 5.1.3, 5.1.4, 5.5.1, 5.5.3
OWASP Top 10 2021: A8
OWASP Top 10: A8
PCI DSS 3.2: 6.5.1
PCI DSS 4.0: 6.2.4
STIG ASD V5R3: V-222609
Run locally
bash
cd codemods/java-security-blocker-mining/java-deserialization-injection-mining
npm test
# Scan a target project (read-only; emits metrics, leaves source unchanged)
npx codemod@latest workflow run \
-w codemods/java-security-blocker-mining/java-deserialization-injection-mining/workflow.yaml \
--target /path/to/java/project
Part of the java-security-blocker-mining suite covering 19 blocker-severity
Java vulnerability rules. Each codemod is read-only and emits a single named metric.
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.