mcp-server-semgrep/semgrep-rules/csharp/lang/security/insecure-deserialization/soap-formatter.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-soapformatter-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.soap.soapformatter?view=netframework-4.8#remarks
    category: security
    technology:
    - .net
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
  message: >-
    The SoapFormatter type is dangerous and is not recommended for data processing. Applications should
    stop using SoapFormatter
    as soon as possible, even if they believe the data they're processing to be trustworthy. SoapFormatter
    is insecure and
    can't be made secure
  patterns:
  - pattern-inside: |
      using System.Runtime.Serialization.Formatters.Soap;
      ...
  - pattern: |
      new SoapFormatter();