unmarshals

Unmarshalling, often written unmarshalling or unmarshaling, is the process of converting serialized data into in-memory data structures. It is the inverse of marshaling (serialization), which transforms in-memory objects into a portable, storable form. Unmarshalling is a core operation in data interchange, enabling programs to reconstruct complex objects from byte streams or text representations.

Common formats involved in unmarshalling include JSON, XML, YAML, Protocol Buffers, and MessagePack. In many programming languages, dedicated functions or APIs perform unmarshalling, sometimes named unmarshal or deserialize. Examples: in Go, json.Unmarshal decodes JSON into a Go value; in Java, JAXB unmarshals XML into Java objects; in Python, json.loads builds Python objects from JSON; in C#, System.Text.Json.Deserialize performs similar work.

Typical steps in unmarshalling involve parsing the serialized input, creating corresponding in-memory objects, coercing and assigning values to fields, and recursively reconstructing nested structures. Parsers may operate in strict mode, requiring all fields to be present and correctly typed, or in permissive mode, allowing defaults for missing data. Some formats support schemas to validate data before or during unmarshalling, while others rely on the parser’s type inference.

Security considerations are important: deserialization can introduce vulnerabilities if input from untrusted sources is allowed to instantiate objects or execute code. Attackers may exploit type confusion, crafted payloads, or excessive object graphs. Best practices include using language- and format-specific safe parsers, enabling strict typing, validating against a schema, and avoiding native deserialization of untrusted data when possible.

Performance and design choices also matter. Unmarshalling can be streaming, parsing input as it is received, or DOM-based, building a complete in-memory representation. Streaming unmarshalling reduces peak memory usage and supports large payloads, but may require more complex code or libraries.