Do Not Serialize Direct Handles to System Resources
es.uniovi.reflection.analyses.cmu.sec56
We detect types implementing java.io.Serializable and defining any non-transient field derived from system resources such as java.io.File, org.omg.CosNaming.NamingContext, org.om.CORBA.DomainManager, etc. This rule encourages programmers to make the detected fields transient.