Q:

Gson Security concerns

I plan to use Gson (http://code.google.com/p/google-gson/) on my server and transfer JavaScript objects from the browser to Java objects on the server. I will use Ajax to POST the request. I am a little concerned that everybody will be able to post Java objects to my server VM. A Java object that runs in the server process will have the potential to do whatever it wants. How does Gson address that?

A:

gson/json is data only, not code. So noone can post code to your server, just data. 
When you're deserializing json, you specify which class (or you just extract primitives or collections of primitives directly) to populate with data - noone can send you json that aribtarly instantiate any of your classes living on the server.

