{"record":{"id":"3c1fbe1e0bc7a793","repo":"flowable/flowable-engine","slug":"serialized-objects-are-not-allowed-3c1fbe","errorCode":null,"errorMessage":"Serialized objects are not allowed","messagePattern":"Serialized objects are not allowed","errorType":"http","errorClass":"FlowableContentNotSupportedException","httpStatus":415,"severity":"error","filePath":"modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/task/TaskVariableBaseResource.java","lineNumber":191,"sourceCode":"            RestVariableScope scope = RestVariableScope.LOCAL;\n            if (variableScope != null) {\n                scope = RestVariable.getScopeFromString(variableScope);\n            }\n\n            if (variableType.equals(CmmnRestResponseFactory.BYTE_ARRAY_VARIABLE_TYPE)) {\n                // Use raw bytes as variable value\n                byte[] variableBytes = IOUtils.toByteArray(file.getInputStream());\n                setVariable(task, variableName, variableBytes, scope, isNew);\n\n            } else if (isSerializableVariableAllowed) {\n                // Try deserializing the object\n                ObjectInputStream stream = new ObjectInputStream(file.getInputStream());\n                Object value = stream.readObject();\n                setVariable(task, variableName, value, scope, isNew);\n                stream.close();\n\n            } else {\n                throw new FlowableContentNotSupportedException(\"Serialized objects are not allowed\");\n            }\n\n            return getVariableFromRequestWithoutAccessCheck(task, variableName, scope, false);\n\n        } catch (IOException ioe) {\n            throw new FlowableIllegalArgumentException(\"Error getting binary variable\", ioe);\n        } catch (ClassNotFoundException ioe) {\n            throw new FlowableContentNotSupportedException(\"The provided body contains a serialized object for which the class was not found: \" + ioe.getMessage());\n        }\n\n    }\n\n    protected RestVariable setSimpleVariable(RestVariable restVariable, Task task, boolean isNew) {\n        if (restVariable.getName() == null) {\n            throw new FlowableIllegalArgumentException(\"Variable name is required\");\n        }\n\n        // Figure out scope, revert to local is omitted","sourceCodeStart":173,"sourceCodeEnd":209,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/service/api/runtime/task/TaskVariableBaseResource.java#L173-L209","documentation":"Thrown by setBinaryVariable when the uploaded multipart file is not recognized as raw binary data or a serialized object upload the endpoint supports. The binary variable endpoint only accepts raw byte streams; posting a serialized object through the wrong content path triggers this. It protects against deserializing arbitrary content.","triggerScenarios":"POST to the task binary variable endpoint with multipart content whose scope/type does not qualify for reading via ObjectInputStream — i.e. content that is neither a plain binary upload nor an accepted serialized object upload.","commonSituations":"Uploading a Java-serialized object to an endpoint configured only for raw binary; content-type negotiation mismatches; clients wrapping the payload in an extra form field.","solutions":["Upload raw byte content and use type 'binary'","If you need object semantics, serialize the payload to JSON and use the JSON variables endpoint","Verify the multipart file field name matches what the endpoint expects (usually 'file')","Check the Flowable version's supported binary upload behavior"],"exampleFix":"// before: multipart file containing a Java-serialized object, type omitted\n// after\ncurl -F 'file=@data.bin' -F 'type=binary' POST /cmmn-runtime/tasks/{id}/variables/{name}","handlingStrategy":"validation","validationCode":"const isFile = (f) => f && typeof f === 'object' && typeof f.pipe === 'function';\nif (!isFile(filePart)) throw new Error('multipart file part is missing or malformed');","typeGuard":"const isRawBinaryUpload = (part) => part != null && part.contentType !== 'application/x-java-serialized-object';","tryCatchPattern":"try { await uploadBinaryVariable(...) } catch (e) { if (e.status === 415) fallbackToJsonVariable(payload); else throw e; }","preventionTips":["Upload raw bytes with type='binary'","Use the JSON variables endpoint for structured values","Match the multipart file field name expected by the endpoint"],"tags":["rest","cmmn","serialization","upload"],"backgroundTag":"unsupported-operation","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}