Unsafe deserialization and object-construction side effects

Mechanism

Deserialization turns bytes into program values and sometimes invokes constructors, hooks, or dynamic type loading. Unsafe formats can therefore cross from untrusted data into code behavior before application validation runs. A signed serialized blob may reduce tampering, but it remains dangerous if the signature is absent, weak, bypassed, or verified after decoding.

Practical method

Identify the serializer, runtime version, and allowed input channel. Inspect whether the format creates only data or arbitrary object types. Trace decoding before downstream business logic. In a local fixture, demonstrate a harmless decode-time side effect and separate it from later use of the resulting value.

import json
# JSON decoding produces data; validate its schema afterward.
record = json.loads(untrusted_text)
# Never unpickle untrusted bytes.

Interpreting evidence

A malformed-object error can reveal a parser but does not establish a reachable gadget. A complete primitive specifies the permitted type, decode hook, side effect, and authentication requirements.

Pitfalls and limits

JSON can still feed unsafe downstream logic. Gadget chains are library-version-specific. Signing must happen over the correct bytes and be verified before invoking a dangerous decoder.