A08:2025 — Software & Data Integrity Failures

01 Integrity Failure Vectors

Integrity failures occur when applications consume serialized objects, code dependencies, or firmware without cryptographic verification of origin and contents:

Insecure Object Deserialization: Passing untrusted strings into native deserializers (e.g. PHP unserialize(), Python pickle.loads(), Java ObjectInputStream) resulting in POP gadget execution or arbitrary property injection.
Missing Subresource Integrity (SRI): Loading third-party CDN scripts or stylesheets without cryptographic hash integrity checking (e.g. integrity="sha384-...").
Unsigned Software Updates: Updating client or server components via HTTP without code-signing verification.

02 Vulnerability Demonstration

Vulnerable Implementation: PHP Native Object Deserialization

Direct consumption of user-controlled cookies through native deserialization.

vulnerable_session.phpPHP

// VULNERABLE: Direct deserialization of client-controlled cookie
if (isset($_COOKIE['user_pref'])) {
    // Unserialize triggers magic methods (__wakeup, __destruct) on instantiated classes
    $pref = unserialize(base64_decode($_COOKIE['user_pref']));
    renderPreferences($pref);
}

03 Audit & Static Code Analysis Rules

Flaw Type	AST / Grep Signature	Remediation
PHP Unserialize	`unserialize\(.*\$`	Use `json_decode()` or safe DTOs
Python Pickle	`pickle\.loads?\(`	Use `json` or `protobuf`
Missing SRI Tag	`<script\s+src=['"]https?://(?!localhost)[^'"]+['"](?![^>]*integrity)`	Add SHA-384 Subresource Integrity attribute

04 Hardened Safe Serialization & SRI Standard

JSON-based Structured Data Handling & SRI HTML

secure_data_integrity.phpPHP 8+ / HTML

// 1. Safe JSON-based state exchange with schema validation
function loadUserPreferences(string $encodedJson): array {
    $data = json_decode($encodedJson, true, 512, JSON_THROW_ON_ERROR);
    
    // Strict schema whitelist validation
    return [
        'theme'     => in_array($data['theme'] ?? '', ['light', 'dark'], true) ? $data['theme'] : 'light',
        'lang'      => preg_match('/^[a-z]{2}(-[A-Z]{2})?$/', $data['lang'] ?? '') ? $data['lang'] : 'en',
        'page_size' => min(100, max(10, (int)($data['page_size'] ?? 25)))
    ];
}

// 2. Subresource Integrity (SRI) on external CDN assets:
// <script src="https://cdn.example.com/lib.js" 
//         integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC" 
//         crossorigin="anonymous"></script>

05 Verification & Compliance Checklist

Integrity Control	Standard	Status
Native Deserializers	Zero usage of untrusted `unserialize()`, `pickle`, or `yaml.load(Loader=Loader)`.	Passed
Subresource Integrity	All third-party CDN scripts specify explicit SHA-256 or SHA-384 hashes.	Passed