mcp-server-semgrep/semgrep-rules/csharp/lang/security/insecure-deserialization/net-data-contract.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-netdatacontract-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.netdatacontractserializer?view=netframework-4.8#security
    category: security
    technology:
    - .net
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
  message: >-
    The NetDataContractSerializer type is dangerous and is not recommended for data processing. Applications
    should stop using
    NetDataContractSerializer as soon as possible, even if they believe the data they're processing to
    be trustworthy. NetDataContractSerializer
    is insecure and can't be made secure
  patterns:
  - pattern-inside: |
      using System.Runtime.Serialization;
      ...
  - pattern: |
      new NetDataContractSerializer();