> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/gridgain/gridgain-8/security/encryption-and-transport/securing-data-deserial.md).

# Securing Data Deserialization

Restrict deserialization in GridGain with the IGNITE\_MARSHALLER\_WHITELIST and IGNITE\_MARSHALLER\_BLACKLIST system properties.

Serialized data is vulnerable to [malicious data attacks](https://lists.apache.org/thread.html/45e7d5e2c6face85aab693f5ae0616563132ff757e5a558da80d0209@%3Cdev.ignite.apache.org%3E) if an attacker finds a way to add malicious code to the classpath of your cluster nodes. Best practice is to make sure that the access to the cluster is protected and granted only to a limited group of people.

However, if the attacker breaks through to your deployment environment, GridGain provides the ability to specify `IGNITE_MARSHALLER_WHITELIST` and `IGNITE_MARSHALLER_BLACKLIST` as **system properties**. These properties allow you to define a list of classes that will be allowed/disallowed for safe deserialization.

## IGNITE\_MARSHALLER\_WHITELIST

To use `IGNITE_MARSHALLER_WHITELIST`, create a file containing the list of files **allowed** for deserialization. For example, a text file (whitelist.txt) would look like so:

{% code title="whitelist.txt" %}

```
ignite.myexamples.model.Address
ignite.myexamples.model.Person
...
```

{% endcode %}

Then, set the system property when you run your application, or programmatically:

{% tabs %}
{% tab title="VM Options" %}

```
-DIGNITE_MARSHALLER_WHITELIST=path/to/whitelist.txt
```

{% endtab %}

{% tab title="Java" %}

```java
System.setProperty(IGNITE_MARSHALLER_WHITELIST, "Path/to/whitelist.txt");
```

{% endtab %}
{% endtabs %}

Substitute `path/to/whitelist.txt` with actual path to your whitelist file.

When the `IGNITE_MARSHALLER_WHITELIST` system property is used, an attempt to deserialize any file not on the whitelist will result in an exception:

{% code title="Text" %}

```
Exception in thread "main" javax.cache.CacheException: class org.apache.ignite.IgniteCheckedException: Deserialization of class ignite.myexamples.model.Organization is disallowed.
```

{% endcode %}

## IGNITE\_MARSHALLER\_BLACKLIST

To use `IGNITE_MARSHALLER_BLACKLIST`, create a file containing the list of files **disallowed** for deserialization. For example, a text file (blacklist.txt) would look like so:

{% code title="blacklist.txt" %}

```
ignite.myexamples.model.SomeFile
ignite.myexamples.model.SomeOtherFile
...
```

{% endcode %}

Then, set the system property when you run your application, or programmatically:

{% tabs %}
{% tab title="VM Options" %}

```
-DIGNITE_MARSHALLER_BLACKLIST=path/to/blacklist.txt
```

{% endtab %}

{% tab title="Java" %}

```java
System.setProperty(IGNITE_MARSHALLER_BLACKLIST, "Path/to/blacklist.txt");
```

{% endtab %}
{% endtabs %}

Substitute `path/to/blacklist.txt` with actual path to your blacklist file.

When the `IGNITE_MARSHALLER_BLACKLIST` system property is used, an attempt to deserialize any file mentioned on the blacklist will result in an exception:

{% code title="Text" %}

```
Exception in thread "main" javax.cache.CacheException: class org.apache.ignite.IgniteCheckedException: Deserialization of class ignite.myexamples.model.SomeOtherFile is disallowed.
```

{% endcode %}

## Thin Client Continuous Query Filters

The whitelist and blacklist also apply to remote filters of continuous queries started from thin clients. A thin client can pass a remote filter by class name, for example with `FactoryBuilder.factoryOf(MyFilter.class)` in the Java thin client, or as a Java filter from the .NET and C++ thin clients. In this case, the server node checks the class name against `IGNITE_MARSHALLER_WHITELIST` and `IGNITE_MARSHALLER_BLACKLIST` before it loads the class. A filter class passed by name must implement `javax.cache.event.CacheEntryEventFilter`.

If the class is not allowed, the continuous query fails with a security error: `Deserialization of class <class name> is disallowed.`

{% hint style="info" %}
In GridGain 8.9.x, filter classes passed by name were not checked. If you use `IGNITE_MARSHALLER_WHITELIST`, add the remote filter classes of your thin client continuous queries to the whitelist before upgrading.
{% endhint %}