Yeah, let's just trust the input stream to *tell us* what class of object to deserialise. What's the worst that c-- https://blogs.apache.org/foundation/entry/apache_commons_statement_to_widespread …
-
The real culprit here is ObjectInputStream.readObject(), which ought to be parameterised with the desired class instead of requiring a cast
At least that way your attack surface doesn't consist of every readObject implementation in every class in every library you use
