mcp-server-semgrep/semgrep-rules/csharp/lang/security/insecure-deserialization/binary-formatter.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-binaryformatter-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
    category: security
    technology:
    - .net
    confidence: HIGH
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: HIGH
  message: >-
    The BinaryFormatter type is dangerous and is not recommended for data processing. Applications should
    stop using BinaryFormatter
    as soon as possible, even if they believe the data they're processing to be trustworthy. BinaryFormatter
    is insecure and can't be made secure
  patterns:
  - pattern-inside: |
      using System.Runtime.Serialization.Formatters.Binary;
      ...
  - pattern: |
      new BinaryFormatter();