Static Analysis Group (Archived) — PDabhi155700 (Community Member) asked a question.
CWE ID 502 (Deserialization of Untrusted Data) Fix
Team,
We have a code that does the following thing
JsonConvert.DeserializeObject<MyCustomObject>(strCustomObject,new JsonSerializerSettings() { TypeNameHandling = TypeNameHandling.None});
As we see that the type name handling is set to None. Still Veracode flags this as an issue. The automatic scanning engine is not able to detect this as a fix.
Is there anything that is required more to fix this?
If not should I mark this as a potential false positive?
Thank you.
Regards,
Pratik
.png){kind=logo}
I'm experiencing the same problem - I'm deserializing into a specific type, which seems to me to be safe. I can't figure out what to do to fix this "issue", or if it's not actually an issue at all.
Hi @CPoynter083905 (Community Member) - Have you got a chance to take a look at what @mat, application security consulting (Veracode, Inc.) shared below? Once you did, can you let us know if that helps of if you still have any question that the team can help with?
Please see this thread: https://community.veracode.com/s/question/0D53400004hAXTuCAO/cwe-502-deserialization-of-untrusted-data-how-to-validate-json-before-deserialization