Insecure serialization and deserialization for Visualforce pages
Why is this an issue?
With Winter '24, Salesforce validates the JsonAccess annotation on Apex classes used with Visualforce JavaScript Remoting. Without proper annotation, classes may fail to serialize/deserialize, breaking functionality.
This validation prevents unauthorized access to class data across namespace boundaries.
Examples
Example of incorrect code:
public class AccountWrapper {
public String name;
public Decimal revenue;
}
Example of correct code:
@JsonAccess(serializable='always' deserializable='always')
public class AccountWrapper {
public String name;
public Decimal revenue;
}
How can I fix violations?
Add the @JsonAccess annotation to classes used with JavaScript Remoting:
serializable='always'- Allows JSON serializationdeserializable='always'- Allows JSON deserializationUse
'sameNamespace'or'samePackage'for more restrictive access
Autofix is supported for this rule.
Resources