mcp-server-semgrep/semgrep-rules/csharp/lang/security/insecure-deserialization/los-formatter.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-losformatter-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.web.ui.losformatter?view=netframework-4.8
    category: security
    technology:
    - .net
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
  message: >-
    The LosFormatter type is dangerous and is not recommended for data processing. Applications should
    stop using LosFormatter
    as soon as possible, even if they believe the data they're processing to be trustworthy. LosFormatter
    is insecure and
    can't be made secure
  patterns:
  - pattern-inside: |
      using System.Web.UI;
      ...
  - pattern: |
      new LosFormatter();