Do Not Serialize Direct Handles to System Resources 

es.uniovi.reflection.analyses.cmu.sec56


We detect types implementing java.io.Serializable and defining any non-transient field derived from system resources such as java.io.File, org.omg.CosNaming.NamingContext, org.om.CORBA.DomainManager or org.omg.PortableInterceptor.ObjectReferenceFactory. This rule encourages programmers to make the detected fields transient.

Computational Reflection Research Group
12-03-2025 17:14
Reliability
Attribute Declaration