A lab demonstration confirms that an application accepts a serialized object and invokes unintended server-side behavior during deserialization. Which control best addresses this risk?

1. Trust every object if it arrives over TLS
2. Avoid unsafe object deserialization and use constrained data formats with validation
3. Increase the server's response timeout
4. Only rename the input field