### Common Characteristics of Deserialization Vulnerabilities

- Special attention: in the data flow, you must first analyze whether the configuration options of the deserialization function pose a risk. The criteria for determining a deserialization vulnerability are as follows:
    - If the deserialized data has been strictly validated and filtered to prevent malicious object injection, the conclusion should be that no security vulnerability exists.
    - If a whitelist mechanism is used to restrict deserialized class types from pointing to arbitrary classes, the conclusion should be that no security vulnerability exists.
    - If the deserialization function uses safe configuration options and dangerous configuration options are not enabled (e.g., Jackson does not use `ObjectMapper.enableDefaultTyping()` or other dangerous configurations), the conclusion should be that no security vulnerability exists.
