All rules →
Rules / C#
SHIELD-CSHARP-008

Insecure deserialization via JavaScriptSerializer SimpleTypeResolver

highC#CWE-502CVSS 8.1

What it detects

JavaScriptSerializer is constructed with a SimpleTypeResolver, permitting arbitrary type deserialization.

How to fix

Construct JavaScriptSerializer without a type resolver or migrate to System.Text.Json.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-008: Insecure deserialization via JavaScriptSerializer SimpleTypeResolver — Zennoxa Shield