## Insecure Deserialization (High)

### Trigger Signals

- `pickle.loads()`/`unserialize()`/`ObjectInputStream` deserializing untrusted data
- `JSON.parse()` followed by direct execution/access (JSON injection)
- XML parser configuration allowing external entities
- `yaml.load()` (not `yaml.safe_load()`)
- `eval()`/`Function()` executing deserialization results

### Key Sinks

| Vulnerability Type | Sink Functions |
|---------|----------|
| Python pickle | `pickle.loads(data)`, `pickle.load(file)` |
| PHP unserialize | `unserialize(data)` |
| Java Deserialization | `ObjectInputStream.readObject()`, `XMLDecoder.readObject()` |
| XXE | `XMLParser`/`DocumentBuilder` (external entities not disabled) |
| YAML | `yaml.load(data)` (not `yaml.safe_load()`) |
| JSON Injection | `JSON.parse(user_input)` directly used for critical operations |

### Judgment Process

1. **Identify Sink**: `Read` extracts deserialization/XML parsing function calls, marking Sink points
2. **Trace back to Source**: `find_references` traces the origin of deserialization input, determining whether it comes from untrusted data (user input, network data, untrusted database columns)
3. **Check XXE protection**: `Read` confirms XML parser configuration:
   - Whether external entities are disabled (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`)
   - Whether DTD is disabled (`setFeature("http://xml.org/sax/features/external-general-entities", false)`)
   - Whether external entity resolution is restricted
4. **Check deserialization protection**: `Read` confirms:
   - Python: whether `pickle.loads` is used for untrusted data (should use safe formats like `json`/`msgpack`)
   - Java: whether whitelist filtering is used (`ObjectInputFilter`)
   - YAML: whether `safe_load` is used (not `load`)
5. **Check JSON injection risk**: `Read` confirms whether `JSON.parse` results are used safely:
   - Whether parsed results are directly used for `eval`, dynamic property access
   - Whether parsed object structure is validated (expected schema)

### Evidence Construction

After confirming a defect, the output must include:
- Source (untrusted data origin, with file:line number)
- Sink (deserialization/parsing location, with file:line number)
- Missing protection (external entities not disabled, safe format not used)
- Exploitation scenario (XXE payload, deserialization gadget chain example)

### Exclusions

- Python `pickle` only used for internal trusted data (not user input)
- XML parsing has external entities and DTD disabled
- Using `yaml.safe_load()` or `json.loads()` instead of unsafe formats
- JSON parsing validates schema before use
