Classic Vulnerable Defaults on security-recipes.aihttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/Recent content in Classic Vulnerable Defaults on security-recipes.aien-usPHP object deserialization — `unserialize` on untrusted datahttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/php-unserialize/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/php-unserialize/Sun, 26 Apr 2026 00:00:00 GMTReplace unsafe `unserialize` usage with JSON or strict allowed-class deserialization; add tests that preserve payload behavior.Ruby unsafe deserialization — `Marshal.load` / `YAML.load`https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/ruby-marshal-yaml-load/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/ruby-marshal-yaml-load/Sun, 26 Apr 2026 00:00:00 GMTReplace `Marshal.load` and unsafe YAML loading with safe parsers, typed coercion, and strict migration tests.Python pickle / dill on untrusted inputhttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/python-pickle/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/python-pickle/Sat, 25 Apr 2026 00:00:00 GMTReplace pickle on untrusted input; mitigate via a restricted unpickler with an explicit class allowlist.PyYAML `yaml.load` without a safe Loaderhttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/pyyaml-load/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/pyyaml-load/Sat, 25 Apr 2026 00:00:00 GMTDefault to `yaml.safe_load`; install an import-time shim that defaults the loader for legacy callers.Java ObjectInputStream and friendshttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/java-deserialization/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/java-deserialization/Sat, 25 Apr 2026 00:00:00 GMTReplace with JSON serializers; mitigate via JEP 290 deserialization filters with a strict class allowlist.XML external entities (XXE) — parser defaultshttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/xxe-xml-defaults/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/xxe-xml-defaults/Sat, 25 Apr 2026 00:00:00 GMTPer-language parser hardening: defusedxml for Python, factory feature flags for Java, libxml entity-loading off in PHP.JWT — `alg: none` and algorithm confusionhttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/jwt-alg-none/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/jwt-alg-none/Sat, 25 Apr 2026 00:00:00 GMTForce an explicit algorithm allowlist on every verify call; reject `none` at the import boundary.JavaScript `eval()` / `new Function()` on untrusted inputhttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/eval-and-function-constructor/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/eval-and-function-constructor/Sat, 25 Apr 2026 00:00:00 GMTReplace with parsers or restricted evaluators; add a CSP `script-src` ban on `unsafe-eval` for browser code.Disabled TLS verification — `verify=False` and friendshttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/requests-verify-false/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/requests-verify-false/Sat, 25 Apr 2026 00:00:00 GMTInstall the right CA bundle; add a fail-closed shim that refuses `verify=False` outside an opt-in test environment.Prototype pollution — `merge`, `assign`, and friendshttps://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/prototype-pollution-merge/https://security-recipes.ai/prompt-library/general/classic-vulnerable-defaults/prototype-pollution-merge/Sat, 25 Apr 2026 00:00:00 GMTFilter `__proto__` / `constructor` / `prototype` keys at parse boundaries; replace hand-rolled merges with vetted utilities.