ast-grep-essentials/tests/csharp/insecure-binaryformatter-deserialization-csharp-test.yml at main · coderabbitai/ast-grep-essentials · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
id: insecure-binaryformatter-deserialization-csharp

invalid:
  - |
    using System.Runtime.Serialization.Formatters.Binary;
    namespace InsecureDeserialization
    {
     public class InsecureBinaryFormatterDeserialization
     {
        public void BinaryFormatterDeserialization(string json)
        {
            try
            {
                BinaryFormatter binaryFormatter = new BinaryFormatter();

                MemoryStream memoryStream = new MemoryStream(Encoding.UTF8.GetBytes(json));
                binaryFormatter.Deserialize(memoryStream);
                memoryStream.Close();
            }
            catch (Exception e)
            {
                Console.WriteLine(e);
            }
        }
    }
    }