mcp-server-semgrep/semgrep-rules/csharp/lang/security/insecure-deserialization/javascript-serializer.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-javascriptserializer-deserialization
  severity: ERROR
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.web.script.serialization.simpletyperesolver?view=netframework-4.8#remarks
    category: security
    technology:
    - .net
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: MEDIUM
  message: >-
    The SimpleTypeResolver class is insecure and should not be used. Using SimpleTypeResolver to deserialize
    JSON could allow
    the remote client to execute malicious code within the app and take control of the web server.
  patterns:
  - pattern-inside: |
      using System.Web.Script.Serialization;
      ...
  - pattern: |
      new JavaScriptSerializer((SimpleTypeResolver $RESOLVER))