Deserialisaation

Deserialisaation, also spelled deserialization or deserialisation, is the process of reconstructing data structures or objects from a serialized representation, typically a byte stream or text. It is the inverse of serialization, which converts in-memory objects into a storable or transmittable form. Deserialization is used in data interchange, persistence, caching, and remote procedure calls, and is supported by many programming languages and frameworks through formats such as JSON, XML, YAML (textual) and binary formats such as Protocol Buffers, Thrift, MessagePack, Avro, and Cap'n Proto.

The general workflow is: read the serialized input, parse according to the format, and instantiate in-memory objects with the restored data. Some formats preserve object graphs with shared or cyclic references; others de-duplicate. In object-oriented languages, deserialization may require constructors or factory methods, and care is needed to re-establish invariants and security constraints.

Security and correctness are major considerations. Deserializing untrusted input can lead to vulnerabilities such as arbitrary code execution, object injection, or data tampering, especially in languages with reflective or code-loading features. Safe practices include validating or whitelisting allowed types, using secure or text-based formats (e.g., JSON) when possible, signing data, checking size limits, and avoiding built-in binary formats like Java's ObjectInputStream, Python's pickle, or .NET BinaryFormatter with untrusted data.

Versioning and compatibility are also important: changes to object schemas or types may break deserialization. Techniques include schema evolution, explicit version fields, and non-breaking field additions.

Deserialization is a foundational mechanism in software systems, enabling persistence and communication, but requires careful handling to mitigate security and compatibility risks.