I'm trying to look for some way for mitigation of insecure deserialization vulnerability for the application front-end
Then I found this link
I saw this in the link:
A8-Insecure Deserialization This type of attack occurs if an application is using custom serialization and deserialization. This attack requires knowledge of that application and type of serialization used.
Usually, it's an issue if sensitive data is serialized and stored using custom serialization functions. An attack vector can be sent as a serialized parameter. There is a possibility of malicious code execution while the parameter is deserialized.
This is not an issue if common serialization techniques like JSON and XML are used. Enforcing strict type constraints can mitigate the risk. Other than that, the application should not accept serialized data from external sources.
I just want to confirm my understanding to the bolded part. Is it correct? That one of way to mitigate this vulnerability is to serialize into json object or xml object then parse it to expected object after deserializing the object?