duplicates: 1.5.2 and 5.5.3

[elarlang]

V1.5.2 Verify that serialization is not used when communicating with untrusted clients. If this is not possible, ensure that deserialization is performed safely, for example by only allowing a white-list of object types or not allowing the client to define the object type to deserialize to, in order to prevent deserialization attacks.

• Levels: 2, 3
• CWE: 502
• Previously related issue: [Clarification/For Discussion] Multiple Clarifications for 1.5.2 #772 (assigning @tghosth @csfreak92 )

V5.5.3 Verify that deserialization of untrusted data is avoided or is protected by filtering incoming deserialization data.

• Levels: 1, 2, 3
• CWE: 502

First recommendation is that we drop 1.5.2 and if needed, content update 5.5.3.

If 1.5.2 need to stay, then:

• "Verify that serialization is not used" > "Verify that deserialization is not used" ?
• replace white-list with something like allow-list

[jmanico]

"Verify that serialization is not used"

You're right this should be deserialization and I prefer the term allow-list.

I like deleting the duplicate, too.

This is a good issue, thanks Elar. I think we are (at least close) to a PR.

[jmanico]

#1095

[elarlang]

So changes - 1.5.2 got moved to 5.5.3 and replaced it.
0f714f0

Still contains "white-list"

[jmanico]

Fixed d1e2cf4