Handling Serialization Safely in Clojure

Serialization: Converting data into a transport or storage format that can later be parsed back into a usable value.

The security question is not whether serialization exists. Every non-trivial system serializes data. The real question is what the parser is allowed to reconstruct and how much trust the system gives that payload after parsing.

The safest default in Clojure is to stay in the data-only zone:

• JSON
• Transit
• EDN through clojure.edn/read-string

The more the format or library tries to rebuild rich executable object graphs, the more dangerous deserialization becomes.

The visual below compares the safe mental model with the risky one: parse into plain data, validate it, and only then let the application treat it as trusted domain input.

Prefer Data-Only Formats Over Executable Object Graphs

Data-only formats are safer because they deserialize into ordinary values rather than arbitrary objects with surprising behavior. In Clojure, that usually means choosing formats that land as maps, vectors, strings, numbers, keywords, and similar plain data.

That is why clojure.edn/read-string is a safer tool than the full reader for untrusted data, and why general Java object deserialization deserves much more suspicion than plain JSON or Transit parsing.

Parsing Is Not Trust

A payload that parsed successfully is still untrusted. After parsing, the next step should be validation:

• shape validation
• size limits
• allowed keys
• allowed value ranges
• semantic checks against current state

 1(ns myapp.events
 2  (:require [cheshire.core :as json]
 3            [clojure.spec.alpha :as s]))
 4
 5(s/def ::event/type keyword?)
 6(s/def ::event/id string?)
 7(s/def ::event/body map?)
 8(s/def ::event
 9  (s/keys :req-un [::event/type ::event/id ::event/body]))
10
11(defn parse-event! [body]
12  (let [payload (json/parse-string body true)]
13    (when-not (s/valid? ::event payload)
14      (throw (ex-info "Invalid event payload" {:payload payload})))
15    payload))

This keeps the trust transition explicit:

1. parse bytes into plain data
2. validate the data shape
3. treat the validated value as an application command or event

read-string Is Not the Same as clojure.edn/read-string

This distinction matters in Clojure security work:

• clojure.core/read-string uses the full reader and is not the right default for untrusted input
• clojure.edn/read-string is the safer data-oriented parser for EDN

If a page, message consumer, or admin tool reads untrusted text, this choice alone can determine whether the system stays in the data-only model or steps into a far riskier parser path.

Size, Depth, and Resource Limits Still Matter

Safe formats can still be abused through:

• huge payloads
• deeply nested structures
• decompression bombs
• repeated malformed input that burns CPU

That means serialization safety is also about operational limits:

• max payload size
• max nesting where practical
• timeout and queue protections
• decompression policy

Signed or MAC-Protected Payloads Solve Integrity, Not Validation

Some systems need assurance that serialized data was not altered in transit. Signatures or message authentication codes help with that, but they do not remove the need for validation. A payload can be authentic and still be:

• semantically invalid
• out of date
• abusive in size
• unauthorized for the receiving workflow

Integrity and validation are related, but they are different jobs.

Common Failure Modes

Treating Successful Parsing as a Security Check

Parsing only means the bytes fit a format.

Using Rich Native Deserialization for Untrusted Data

That is where surprising behavior and gadget-style exploitation often start.

Forgetting Resource Limits

Even data-only formats can become denial-of-service vectors if size and complexity are unconstrained.

Logging Entire Failed Payloads

Malformed or malicious payloads can still carry secrets, personal data, or exploit strings you do not want sprayed across logs.

Practical Heuristics

Prefer data-only formats, use clojure.edn/read-string instead of the full reader for untrusted EDN, and treat parsing as only the first step before validation. Add payload-size limits, integrity protections where needed, and careful failure logging. In Clojure, safe serialization is mostly about refusing to blur the line between “plain data” and “objects with behavior.”

Ready to Test Your Knowledge?