Verification · Threat modeling · Attack surface inventory
Data parsers and deserialization
File, archive and object parsers that take untrusted input.
How to build it
- List each parser for uploaded files, archives and serialized objects.
- Mark each parser as a component that takes untrusted input in the threat model.
- Record the size limits and parser libraries used for each input type.
Signals in a repository
- A threat model entry for each file, archive or deserialization parser.
- Parser library versions pinned in the lockfile for the upload and deserialization code.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.