> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/ocular/tutorials/deserialization.md).

# Find Deserialization Sinks in a Java Application

OWASP provides a [Deserialization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) that offers guidance on how to safely deserialize untrusted data.

You can use Ocular to search for references to the relevant methods:

```
def sinkMethods = cpg.method.or(
_.fullName(".*(XMLdecoder|ObjectInputStream).*readObject.*"),
_.fullName(".*XStream.*fromXML.*"),
_.fullName(".*readObjectNodData|readResolve|readExternal.*"),
_.fullName(".*ObjectInputStream.*readUnshared.*"))

sinkMethods.calledBy(cpg.method).newCallChain.p
```

![](/files/DfHDmRpYn5HJOmhRtTva) ![](/files/P5vj8JOtHNJWVEvAqKym)

The OWASP guide also suggests hardening classes derived from `Serializable`. Ocular can help you identify classes that inherit directly from `Serializable`

```
cpg.typeDecl.name("Serializable").derivedTypeDecl.fullName.l
```

![](/files/DfHDmRpYn5HJOmhRtTva) ![](/files/P5vj8JOtHNJWVEvAqKym)

To get a list of classes that inherit from `Serializable` (either directly or indirectly), use:

```
cpg.typeDecl.name("Serializable").derivedTypeDeclTransitive.fullName.l
```

![](/files/DfHDmRpYn5HJOmhRtTva) ![](/files/P5vj8JOtHNJWVEvAqKym)

In the context of deserialization vulnerabilities, you may also want to review the library version. For example, to determine the version of the "XStream" library in use, run:

```
cpg.dependency.name(".*xstream.*").version.l
```

![](/files/DfHDmRpYn5HJOmhRtTva) ![](/files/P5vj8JOtHNJWVEvAqKym)