Do Not Serialize Direct Handles to System Resources 

es.uniovi.reflection.analyses.cmu.sec56


We detect types implementing java.io.Serializable and defining any non-transient field derived from system resources such as java.io.File, org.omg.CosNaming.NamingContext, org.om.CORBA.DomainManager, etc. This rule encourages programmers to make the detected fields transient.

Computational Reflection Research Group
05-08-2024 22:58
Reliability
Field Definition