{
  "sinks": [
    {
      "method": "readObject",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": [],
      "note": "Java deserialization RCE - can trigger gadget chains"
    },
    {
      "method": "readUnshared",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": [],
      "note": "Java deserialization RCE - unshared objects"
    },
    {
      "method": "ObjectInputStream",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": [
        0
      ],
      "note": "Creating ObjectInputStream with untrusted data"
    },
    {
      "method": "readObject",
      "class": "XMLDecoder",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": []
    },
    {
      "method": "XMLDecoder",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    },
    {
      "method": "fromXML",
      "class": "XStream",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    },
    {
      "method": "unmarshal",
      "class": "XStream",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    },
    {
      "method": "load",
      "class": "Yaml",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": [
        0
      ],
      "note": "SnakeYAML unsafe deserialization"
    },
    {
      "method": "loadAll",
      "class": "Yaml",
      "type": "insecure_deserialization",
      "cwe": "CWE-502",
      "severity": "critical",
      "arg_positions": [
        0
      ]
    }
  ],
  "sanitizers": [
    {
      "method": "resolveClass",
      "removes": [
        "insecure_deserialization"
      ],
      "note": "Custom ObjectInputStream with class whitelist"
    },
    {
      "method": "readValue",
      "class": "ObjectMapper",
      "removes": [
        "insecure_deserialization"
      ],
      "note": "JSON deserialization (safe if default typing disabled)"
    },
    {
      "method": "setupDefaultSecurity",
      "class": "XStream",
      "removes": [
        "insecure_deserialization",
        "deserialization"
      ],
      "note": "XStream 1.4.18+ hardened default security. Added 3.153.0 (#233)."
    },
    {
      "method": "allowTypes",
      "class": "XStream",
      "removes": [
        "insecure_deserialization",
        "deserialization"
      ],
      "note": "XStream type whitelist — restricts deserialized types. Added 3.153.0 (#233)."
    },
    {
      "method": "allowTypeHierarchy",
      "class": "XStream",
      "removes": [
        "insecure_deserialization",
        "deserialization"
      ],
      "note": "XStream type-hierarchy whitelist. Added 3.153.0 (#233)."
    },
    {
      "method": "allowTypesByRegExp",
      "class": "XStream",
      "removes": [
        "insecure_deserialization",
        "deserialization"
      ],
      "note": "XStream regex type whitelist. Added 3.153.0 (#233)."
    },
    {
      "method": "allowTypesByWildcard",
      "class": "XStream",
      "removes": [
        "insecure_deserialization",
        "deserialization"
      ],
      "note": "XStream wildcard type whitelist. Added 3.153.0 (#233)."
    },
    {
      "method": "denyTypes",
      "class": "XStream",
      "removes": [
        "insecure_deserialization",
        "deserialization"
      ],
      "note": "XStream deny-list. Added 3.153.0 (#233)."
    }
  ]
}