{"action":"created","comment":{"url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/comments/122637265","pull_request_review_id":44768553,"id":122637265,"diff_hunk":"@@ -804,48 +804,210 @@ Another compliant solution is to define the API level to 17 (JELLY_BEAN_MR1) and\n \n \n \n-### Testing Object persistance\n+### Testing Object Persistence\n \n #### Overview\n \n-There are various ways to persistn an object within Android:\n+There are various ways to persist an object within Android:\n \n ##### Object Serialization\n \n-An object and its data can be represented as a sequence of bytes. In Java, this is possible using object serialization <sup>[1]</sup>. Serialization is not secure by default and is just a binary format or representation that can be used to store data locally as .ser file. It is possible to sign and encrypt serialized data but, if the source code is available, this is always reversible.  \n+An object and its data can be represented as a sequence of bytes. In Java, this is possible using object serialization <sup>[1]</sup>. Serialization is not secure by default and is just a binary format or representation that can be used to store data locally as .ser file. It is possible to encrypt and sign/HMAC serialized data as long as the keys are stored safely. Note that, when classes are changed, the `ObjectInputStream` will not be able to create objects from older .ser files.","path":"Document/0x05h-Testing-Platform-Interaction.md","position":15,"original_position":15,"commit_id":"067175eeed7c870582c1c67b54718ad024b6feb3","original_commit_id":"905661c3e940f251a1f8ac7435a340940342c76e","user":{"login":"commjoen","id":1457214,"avatar_url":"https://avatars0.githubusercontent.com/u/1457214?v=3","gravatar_id":"","url":"https://api.github.com/users/commjoen","html_url":"https://github.com/commjoen","followers_url":"https://api.github.com/users/commjoen/followers","following_url":"https://api.github.com/users/commjoen/following{/other_user}","gists_url":"https://api.github.com/users/commjoen/gists{/gist_id}","starred_url":"https://api.github.com/users/commjoen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/commjoen/subscriptions","organizations_url":"https://api.github.com/users/commjoen/orgs","repos_url":"https://api.github.com/users/commjoen/repos","events_url":"https://api.github.com/users/commjoen/events{/privacy}","received_events_url":"https://api.github.com/users/commjoen/received_events","type":"User","site_admin":false},"body":"Fixed it.","created_at":"2017-06-19T07:33:03Z","updated_at":"2017-06-19T07:33:03Z","html_url":"https://github.com/OWASP/owasp-mstg/pull/572#discussion_r122637265","pull_request_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/572","_links":{"self":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/comments/122637265"},"html":{"href":"https://github.com/OWASP/owasp-mstg/pull/572#discussion_r122637265"},"pull_request":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/572"}}},"pull_request":{"url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/572","id":126050423,"html_url":"https://github.com/OWASP/owasp-mstg/pull/572","diff_url":"https://github.com/OWASP/owasp-mstg/pull/572.diff","patch_url":"https://github.com/OWASP/owasp-mstg/pull/572.patch","issue_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/572","number":572,"state":"open","locked":false,"title":"0x05h/android deserialization","user":{"login":"commjoen","id":1457214,"avatar_url":"https://avatars0.githubusercontent.com/u/1457214?v=3","gravatar_id":"","url":"https://api.github.com/users/commjoen","html_url":"https://github.com/commjoen","followers_url":"https://api.github.com/users/commjoen/followers","following_url":"https://api.github.com/users/commjoen/following{/other_user}","gists_url":"https://api.github.com/users/commjoen/gists{/gist_id}","starred_url":"https://api.github.com/users/commjoen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/commjoen/subscriptions","organizations_url":"https://api.github.com/users/commjoen/orgs","repos_url":"https://api.github.com/users/commjoen/repos","events_url":"https://api.github.com/users/commjoen/events{/privacy}","received_events_url":"https://api.github.com/users/commjoen/received_events","type":"User","site_admin":false},"body":"Intermediary PR: need to add dynamic analysis and remediation. (WIP)","created_at":"2017-06-16T14:53:22Z","updated_at":"2017-06-19T07:33:03Z","closed_at":null,"merged_at":null,"merge_commit_sha":"ce41b7a62a39b20a6dbe6ac97d5a9b0c2228517c","assignee":null,"assignees":[],"requested_reviewers":[{"login":"bolot","id":1553985,"avatar_url":"https://avatars2.githubusercontent.com/u/1553985?v=3","gravatar_id":"","url":"https://api.github.com/users/bolot","html_url":"https://github.com/bolot","followers_url":"https://api.github.com/users/bolot/followers","following_url":"https://api.github.com/users/bolot/following{/other_user}","gists_url":"https://api.github.com/users/bolot/gists{/gist_id}","starred_url":"https://api.github.com/users/bolot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bolot/subscriptions","organizations_url":"https://api.github.com/users/bolot/orgs","repos_url":"https://api.github.com/users/bolot/repos","events_url":"https://api.github.com/users/bolot/events{/privacy}","received_events_url":"https://api.github.com/users/bolot/received_events","type":"User","site_admin":false},{"login":"sushi2k","id":5951320,"avatar_url":"https://avatars3.githubusercontent.com/u/5951320?v=3","gravatar_id":"","url":"https://api.github.com/users/sushi2k","html_url":"https://github.com/sushi2k","followers_url":"https://api.github.com/users/sushi2k/followers","following_url":"https://api.github.com/users/sushi2k/following{/other_user}","gists_url":"https://api.github.com/users/sushi2k/gists{/gist_id}","starred_url":"https://api.github.com/users/sushi2k/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sushi2k/subscriptions","organizations_url":"https://api.github.com/users/sushi2k/orgs","repos_url":"https://api.github.com/users/sushi2k/repos","events_url":"https://api.github.com/users/sushi2k/events{/privacy}","received_events_url":"https://api.github.com/users/sushi2k/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/572/commits","review_comments_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/572/comments","review_comment_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/comments{/number}","comments_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/572/comments","statuses_url":"https://api.github.com/repos/OWASP/owasp-mstg/statuses/067175eeed7c870582c1c67b54718ad024b6feb3","head":{"label":"OWASP:0x05h/android_deserialization","ref":"0x05h/android_deserialization","sha":"067175eeed7c870582c1c67b54718ad024b6feb3","user":{"login":"OWASP","id":155815,"avatar_url":"https://avatars3.githubusercontent.com/u/155815?v=3","gravatar_id":"","url":"https://api.github.com/users/OWASP","html_url":"https://github.com/OWASP","followers_url":"https://api.github.com/users/OWASP/followers","following_url":"https://api.github.com/users/OWASP/following{/other_user}","gists_url":"https://api.github.com/users/OWASP/gists{/gist_id}","starred_url":"https://api.github.com/users/OWASP/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OWASP/subscriptions","organizations_url":"https://api.github.com/users/OWASP/orgs","repos_url":"https://api.github.com/users/OWASP/repos","events_url":"https://api.github.com/users/OWASP/events{/privacy}","received_events_url":"https://api.github.com/users/OWASP/received_events","type":"Organization","site_admin":false},"repo":{"id":69648386,"name":"owasp-mstg","full_name":"OWASP/owasp-mstg","owner":{"login":"OWASP","id":155815,"avatar_url":"https://avatars3.githubusercontent.com/u/155815?v=3","gravatar_id":"","url":"https://api.github.com/users/OWASP","html_url":"https://github.com/OWASP","followers_url":"https://api.github.com/users/OWASP/followers","following_url":"https://api.github.com/users/OWASP/following{/other_user}","gists_url":"https://api.github.com/users/OWASP/gists{/gist_id}","starred_url":"https://api.github.com/users/OWASP/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OWASP/subscriptions","organizations_url":"https://api.github.com/users/OWASP/orgs","repos_url":"https://api.github.com/users/OWASP/repos","events_url":"https://api.github.com/users/OWASP/events{/privacy}","received_events_url":"https://api.github.com/users/OWASP/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/OWASP/owasp-mstg","description":" The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing and reverse engineering.","fork":false,"url":"https://api.github.com/repos/OWASP/owasp-mstg","forks_url":"https://api.github.com/repos/OWASP/owasp-mstg/forks","keys_url":"https://api.github.com/repos/OWASP/owasp-mstg/keys{/key_id}","collaborators_url":"https://api.github.com/repos/OWASP/owasp-mstg/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/OWASP/owasp-mstg/teams","hooks_url":"https://api.github.com/repos/OWASP/owasp-mstg/hooks","issue_events_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/events{/number}","events_url":"https://api.github.com/repos/OWASP/owasp-mstg/events","assignees_url":"https://api.github.com/repos/OWASP/owasp-mstg/assignees{/user}","branches_url":"https://api.github.com/repos/OWASP/owasp-mstg/branches{/branch}","tags_url":"https://api.github.com/repos/OWASP/owasp-mstg/tags","blobs_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/refs{/sha}","trees_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/trees{/sha}","statuses_url":"https://api.github.com/repos/OWASP/owasp-mstg/statuses/{sha}","languages_url":"https://api.github.com/repos/OWASP/owasp-mstg/languages","stargazers_url":"https://api.github.com/repos/OWASP/owasp-mstg/stargazers","contributors_url":"https://api.github.com/repos/OWASP/owasp-mstg/contributors","subscribers_url":"https://api.github.com/repos/OWASP/owasp-mstg/subscribers","subscription_url":"https://api.github.com/repos/OWASP/owasp-mstg/subscription","commits_url":"https://api.github.com/repos/OWASP/owasp-mstg/commits{/sha}","git_commits_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/commits{/sha}","comments_url":"https://api.github.com/repos/OWASP/owasp-mstg/comments{/number}","issue_comment_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/comments{/number}","contents_url":"https://api.github.com/repos/OWASP/owasp-mstg/contents/{+path}","compare_url":"https://api.github.com/repos/OWASP/owasp-mstg/compare/{base}...{head}","merges_url":"https://api.github.com/repos/OWASP/owasp-mstg/merges","archive_url":"https://api.github.com/repos/OWASP/owasp-mstg/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/OWASP/owasp-mstg/downloads","issues_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues{/number}","pulls_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls{/number}","milestones_url":"https://api.github.com/repos/OWASP/owasp-mstg/milestones{/number}","notifications_url":"https://api.github.com/repos/OWASP/owasp-mstg/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/OWASP/owasp-mstg/labels{/name}","releases_url":"https://api.github.com/repos/OWASP/owasp-mstg/releases{/id}","deployments_url":"https://api.github.com/repos/OWASP/owasp-mstg/deployments","created_at":"2016-09-30T08:22:29Z","updated_at":"2017-06-19T07:22:42Z","pushed_at":"2017-06-19T07:31:30Z","git_url":"git://github.com/OWASP/owasp-mstg.git","ssh_url":"git@github.com:OWASP/owasp-mstg.git","clone_url":"https://github.com/OWASP/owasp-mstg.git","svn_url":"https://github.com/OWASP/owasp-mstg","homepage":"https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide","size":52352,"stargazers_count":1137,"watchers_count":1137,"language":"HTML","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":195,"mirror_url":null,"open_issues_count":135,"forks":195,"open_issues":135,"watchers":1137,"default_branch":"master"}},"base":{"label":"OWASP:master","ref":"master","sha":"2ea0f0cf08a1ba002f9db6df1a97d257a02dfb08","user":{"login":"OWASP","id":155815,"avatar_url":"https://avatars3.githubusercontent.com/u/155815?v=3","gravatar_id":"","url":"https://api.github.com/users/OWASP","html_url":"https://github.com/OWASP","followers_url":"https://api.github.com/users/OWASP/followers","following_url":"https://api.github.com/users/OWASP/following{/other_user}","gists_url":"https://api.github.com/users/OWASP/gists{/gist_id}","starred_url":"https://api.github.com/users/OWASP/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OWASP/subscriptions","organizations_url":"https://api.github.com/users/OWASP/orgs","repos_url":"https://api.github.com/users/OWASP/repos","events_url":"https://api.github.com/users/OWASP/events{/privacy}","received_events_url":"https://api.github.com/users/OWASP/received_events","type":"Organization","site_admin":false},"repo":{"id":69648386,"name":"owasp-mstg","full_name":"OWASP/owasp-mstg","owner":{"login":"OWASP","id":155815,"avatar_url":"https://avatars3.githubusercontent.com/u/155815?v=3","gravatar_id":"","url":"https://api.github.com/users/OWASP","html_url":"https://github.com/OWASP","followers_url":"https://api.github.com/users/OWASP/followers","following_url":"https://api.github.com/users/OWASP/following{/other_user}","gists_url":"https://api.github.com/users/OWASP/gists{/gist_id}","starred_url":"https://api.github.com/users/OWASP/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OWASP/subscriptions","organizations_url":"https://api.github.com/users/OWASP/orgs","repos_url":"https://api.github.com/users/OWASP/repos","events_url":"https://api.github.com/users/OWASP/events{/privacy}","received_events_url":"https://api.github.com/users/OWASP/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/OWASP/owasp-mstg","description":" The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security testing and reverse engineering.","fork":false,"url":"https://api.github.com/repos/OWASP/owasp-mstg","forks_url":"https://api.github.com/repos/OWASP/owasp-mstg/forks","keys_url":"https://api.github.com/repos/OWASP/owasp-mstg/keys{/key_id}","collaborators_url":"https://api.github.com/repos/OWASP/owasp-mstg/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/OWASP/owasp-mstg/teams","hooks_url":"https://api.github.com/repos/OWASP/owasp-mstg/hooks","issue_events_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/events{/number}","events_url":"https://api.github.com/repos/OWASP/owasp-mstg/events","assignees_url":"https://api.github.com/repos/OWASP/owasp-mstg/assignees{/user}","branches_url":"https://api.github.com/repos/OWASP/owasp-mstg/branches{/branch}","tags_url":"https://api.github.com/repos/OWASP/owasp-mstg/tags","blobs_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/refs{/sha}","trees_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/trees{/sha}","statuses_url":"https://api.github.com/repos/OWASP/owasp-mstg/statuses/{sha}","languages_url":"https://api.github.com/repos/OWASP/owasp-mstg/languages","stargazers_url":"https://api.github.com/repos/OWASP/owasp-mstg/stargazers","contributors_url":"https://api.github.com/repos/OWASP/owasp-mstg/contributors","subscribers_url":"https://api.github.com/repos/OWASP/owasp-mstg/subscribers","subscription_url":"https://api.github.com/repos/OWASP/owasp-mstg/subscription","commits_url":"https://api.github.com/repos/OWASP/owasp-mstg/commits{/sha}","git_commits_url":"https://api.github.com/repos/OWASP/owasp-mstg/git/commits{/sha}","comments_url":"https://api.github.com/repos/OWASP/owasp-mstg/comments{/number}","issue_comment_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues/comments{/number}","contents_url":"https://api.github.com/repos/OWASP/owasp-mstg/contents/{+path}","compare_url":"https://api.github.com/repos/OWASP/owasp-mstg/compare/{base}...{head}","merges_url":"https://api.github.com/repos/OWASP/owasp-mstg/merges","archive_url":"https://api.github.com/repos/OWASP/owasp-mstg/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/OWASP/owasp-mstg/downloads","issues_url":"https://api.github.com/repos/OWASP/owasp-mstg/issues{/number}","pulls_url":"https://api.github.com/repos/OWASP/owasp-mstg/pulls{/number}","milestones_url":"https://api.github.com/repos/OWASP/owasp-mstg/milestones{/number}","notifications_url":"https://api.github.com/repos/OWASP/owasp-mstg/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/OWASP/owasp-mstg/labels{/name}","releases_url":"https://api.github.com/repos/OWASP/owasp-mstg/releases{/id}","deployments_url":"https://api.github.com/repos/OWASP/owasp-mstg/deployments","created_at":"2016-09-30T08:22:29Z","updated_at":"2017-06-19T07:22:42Z","pushed_at":"2017-06-19T07:31:30Z","git_url":"git://github.com/OWASP/owasp-mstg.git","ssh_url":"git@github.com:OWASP/owasp-mstg.git","clone_url":"https://github.com/OWASP/owasp-mstg.git","svn_url":"https://github.com/OWASP/owasp-mstg","homepage":"https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide","size":52352,"stargazers_count":1137,"watchers_count":1137,"language":"HTML","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":195,"mirror_url":null,"open_issues_count":135,"forks":195,"open_issues":135,"watchers":1137,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/572"},"html":{"href":"https://github.com/OWASP/owasp-mstg/pull/572"},"issue":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/issues/572"},"comments":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/issues/572/comments"},"review_comments":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/572/comments"},"review_comment":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/pulls/572/commits"},"statuses":{"href":"https://api.github.com/repos/OWASP/owasp-mstg/statuses/067175eeed7c870582c1c67b54718ad024b6feb3"}}}}
{"actor":{"display_login":"commjoen"}}