Defensive Architecture: Java Deserialization via HEAD Request

The flaw occurs because the application consumes the input stream and attempts to deserialize it before validating the HTTP method. An attacker can send a serialized payload in the body of a HEAD request, which many WAFs will allow through without inspection.

// Vulnerable Pattern in Method-Agnostic Handler
public void handleRequest(HttpServletRequest req, HttpServletResponse resp) {
    // The handler does not check if req.getMethod().equals("HEAD")
    try (ObjectInputStream ois = new ObjectInputStream(req.getInputStream())) {
        Object obj = ois.readObject(); // RCE triggered here via gadget chain
        processObject(obj);
    } catch (Exception e) {
        log.error("Deserialization failed", e);
    }
}

Implement a strict method check before accessing the input stream. For HEAD requests, the input stream should be closed or ignored immediately. Additionally, use a ValidatingObjectInputStream to allowlist only expected classes.