Deserialized delegate¶
ID: cs/deserialized-delegate Kind: problem Security severity: 9.8 Severity: warning Precision: high Tags: - security - external/cwe/cwe-502 Query suites: - csharp-code-scanning.qls - csharp-security-extended.qls - csharp-security-and-quality.qls Click to see the query in the CodeQL repository
Deserializing a delegate object may result in remote code execution, when an attacker can control the serialized data.
Recommendation¶
Avoid deserializing delegate objects, if possible, or make sure that the serialized data cannot be controlled by an attacker.
Example¶
In this example, a file stream is deserialized to a Func<int> object, using a BinaryFormatter. The file stream is a parameter of a public method, so depending on the calls to InvokeSerialized, this may or may not pose a security problem.
usingSystem;usingSystem.IO;usingSystem.Runtime.Serialization.Formatters.Binary;classBad{publicstaticintInvokeSerialized(FileStreamfs){varformatter=newBinaryFormatter();// BADvarf=(Func<int>)formatter.Deserialize(fs);returnf();}}References¶
Microsoft: BinaryFormatter Class.
Common Weakness Enumeration: CWE-502.
