deserialization-review

Audit Rust serde deserialization by mapping untrusted input boundaries to trust buckets, then applying checks for size limits, recursion depth, deny_unknown_fields, and non-panicking error paths.

Kubernetes CRD spec re-deserialization vulnerabilities include missing framing-level size limits, uncontrolled recursion depth, unsafe flatten footguns, and panicking error paths that compromise reliability.

Regex recompilation during Deserialize-time construction triggers ReDoS by allowing pathological patterns to execute against untrusted payloads, requiring targeted bounds to mitigate recompilation risk.

Prevent panics deserializing gRPC config sync payloads by enforcing non-panicking requirements on error paths and applying strict recursion depth control and unknown-field validation.

Yes, serde flatten introduces safety risks by obscuring unknown-field behavior and bypassing strict structural validation, requiring dedicated flatten footgun auditing during deserialization reviews.

Review DSL bytecode base64 deserialization by applying threat-model-driven checks for framing-level size limits, recursion depth, and ensuring deserialization errors do not panic.