include::../description.adoc[]

== Noncompliant Code Example

For https://docs.microsoft.com/en-us/dotnet/api/system.xml.serialization.xmlserializer?view=netframework-4.8[XmlSerializer ] serializer, the expected type should not come from user-controlled input:

----
public class XmlSerializerTestCase : Controller
{
   public ActionResult unsecuredeserialization(string typeName)
  {
     // ....
     ExpectedType obj = null;
     Type t = Type.GetType(typeName); // typeName is user-controlled
     XmlSerializer serializer = new XmlSerializer(t); // Noncompliant
     obj = (ExpectedType) serializer.Deserialize(fs);
     // ....
   }
}
----

== Compliant Solution

For https://docs.microsoft.com/en-us/dotnet/api/system.xml.serialization.xmlserializer?view=netframework-4.8[XmlSerializer ] serializer:

----
public class XmlSerializerTestCase : Controller
{
   public ActionResult securedeserialization()
  {
     // ....
     ExpectedType obj = null;
     XmlSerializer serializer = new XmlSerializer(typeof(ExpectedType)); // Compliant
     obj = (ExpectedType) serializer.Deserialize(fs);
     // ....
   }
}
----

== See

* https://www.owasp.org/index.php/Top_10-2017_A8-Insecure_Deserialization[OWASP Top 10 2017 Category A8] - Insecure Deserialization
* https://cwe.mitre.org/data/definitions/134.html[MITRE, CWE-134] - Use of Externally-Controlled Format String
* https://cwe.mitre.org/data/definitions/502.html[MITRE, CWE-502] - Deserialization of Untrusted Data
* https://www.sans.org/top25-software-errors/#cat2[SANS Top 25] - Risky Resource Management