Java 25

Validate Java 25 values at process, privilege, and trust boundaries. Constrain binding, reflection, serialization, native code, and generated code; each can bypass type guarantees.

Input and queries

• Validate untrusted type, length, syntax, range, encoding, and allowed values before building domain objects.
• Use records with immutable or defensively copied components, or dedicated request types; reject unknown properties for privileged commands.
• Exclude server-owned ownership, role, price, status, and audit fields from client-bindable types.
• Bound length and reject malformed encoding, then canonicalize with the protocol's Unicode form (java.text.Normalizer) or Path.normalize()/toRealPath(); allowlist, authorize, and act on that same value.
• Distrust environment variables, properties, headers, message metadata, database text, and service responses.
• For injection-safe queries, bind JDBC PreparedStatement placeholders with setXxx; never concatenate request data into JDBC, JPQL, HQL, or Criteria fragments.
• Allowlist SQL structure (tables, columns, ordering); binding protects values, not identifiers.

Serialization

• Never natively deserialize untrusted or remote bytes.
• For unavoidable legacy input, install an ObjectInputFilter before reading (ObjectInputStream.setObjectInputFilter or startup jdk.serialFilter) with maxdepth, maxrefs, maxarray, maxbytes, and a class allowlist ending in !* for pattern filters.
• Bound input bytes separately: primitives and concretely encoded strings bypass the filter, maxbytes included.
• Never