Unmarshaling

Unmarshaling is the process of converting serialized data into in-memory data structures. It is the reverse operation of marshaling (serialization). Unmarshalling is a common step in data interchange, storage, and inter-process communication, occurring after data is received or read from a file or network. The term is often used interchangeably with deserialization.

In practice, unmarshaling involves parsing the input according to a format (such as JSON, XML, YAML, Protocol Buffers, or a binary protocol) and constructing corresponding language-native objects, such as dictionaries, lists, or user-defined classes. The process may include type conversion, field mapping, and validation against a schema or type definitions to ensure the in-memory representation matches expected structures.

Security and robustness concerns accompany unmarshaling, particularly when handling untrusted input. Deserialization flaws can lead to code execution, elevated privileges, or denial of service. Mitigations include strict schemas and validation, avoiding automatic loading of arbitrary types, using safer deserialization modes, and keeping libraries up to date.

Unmarshaling is widely used in web services, APIs, configuration loading, message passing, and data persistence. Language ecosystems typically expose an unmarshal or parse API, such as Unmarshal in Go, JSON.parse equivalents in many languages, JAXB in Java, or protobuf ParseFrom methods for binary formats.