Примеры ошибок, обнаруженных с помощью диагностики V5611
V5611. OWASP. Potential insecure deserialization vulnerability. Potentially tainted data is used to create an object using deserialization.
Power-Fx
V5611 [CWE-502, OWASP-1.5.2, OWASP-5.5.3] Possible insecure deserialization. Potentially tainted data in the 'json' variable is used to deserialize an object. EngineSchemaChecker.cs 31
public static void Check(Engine engine, string pathInput)
{
EngineSchema schema;
if (pathInput != null)
{
var json = File.ReadAllText(pathInput);
schema = JsonSerializer.Deserialize<EngineSchema>(json);
}
....
}
Similar errors can be found in some other places:
- V5611 [CWE-502, OWASP-1.5.2, OWASP-5.5.3] Possible insecure deserialization. Potentially tainted data in the 'expected' variable is used to deserialize an object. FormulaTypeSerializerSnapshotTests.cs 62
