mcp-server-semgrep/semgrep-rules/csharp/lang/security/insecure-deserialization/newtonsoft.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-newtonsoft-deserialization
  patterns:
  - pattern-either:
        # handles most inline configurations
    - pattern: TypeNameHandling = TypeNameHandling.$TYPEHANDLER
    - pattern: |
        $SETTINGS.TypeNameHandling = TypeNameHandling.$TYPEHANDLER;
        ...
        JsonConvert.DeserializeObject<$TYPE>(...,$SETTINGS);
    - pattern: |
        $SETTINGS.TypeNameHandling = TypeNameHandling.$TYPEHANDLER;
        ...
        JsonConvert.DeserializeObject(...,$SETTINGS);
  - pattern-inside: |
      using Newtonsoft.Json;
      ...
  - metavariable-regex:
      metavariable: $TYPEHANDLER
      regex: (All|Auto|Objects|Arrays)
  message: TypeNameHandling $TYPEHANDLER is unsafe and can lead to arbitrary code execution in the context
    of the process. Use a custom SerializationBinder whenever using a setting other than TypeNameHandling.None.
  languages:
  - csharp
  severity: WARNING
  metadata:
    category: security
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://www.newtonsoft.com/json/help/html/T_Newtonsoft_Json_TypeNameHandling.htm#remarks
    technology:
    - .net
    - newtonsoft
    - json
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH