Find insecure deserialization

Proprietary

Finds BinaryFormatter, SoapFormatter, NetDataContractSerializer, LosFormatter and ObjectStateFormatter, JavaScriptSerializer with a SimpleTypeResolver, and Json.NET TypeNameHandling settings other than None. Deserializing untrusted data with these lets an attacker instantiate arbitrary types and execute code.

OpenRewrite.Recipes.CSharp.Security.FindInsecureDeserialization

mod run . --recipe=OpenRewrite.Recipes.CSharp.Security.FindInsecureDeserialization

Install it once, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.