Deserializing of untrusted data using C#

Question

I have the following C# code which is getting a "high" error from Checkmarx. I can't see anything wrong with it.

var dataDirectoryPath = AppDomain.CurrentDomain.GetData("DataDirectory").ToString(); 
var json = File.ReadAllText($"{dataDirectoryPath}{Path.DirectorySeparatorChar}somefile.json");

var settings = new
    JsonSerializerSettings{TypeNameHandling=TypeNameHandling.None};     
var targetPathSettings = JsonConvert.DeserializeObject<List<TargetPathSetting>>(json, settings);

It gives this error:

The serialized object ReadAllText processed in xxx in the file yyy is deserialized by DeserializeObject in the file zzz

The C# code is as follows:

public class TargetPathSetting
{
    public string PathSettingName { get; set; }
    public PathSetting PathSetting { get; set; }
}


public class PathSetting
{
    public string BaseUrl { get; set; }
    public string ApplicationIdUri { get; set; }
}

I can't see that anything that is ever in the file is going to cause any sort of problem, especially with the TypeNameHandling.None setting.

It's a fragment of a larger bit of code but the json file is a variable in the actual code. Does that matter? — Rob Sedgwick, Aug 13 '19 at 12:45
I don't know. Do you know what is the name of the error? Is this `Deserialization_of_Untrusted_Data`? — baruchiro, Aug 13 '19 at 12:51
I have edited the question to add the actual code to get the filename — Rob Sedgwick, Aug 13 '19 at 13:56
this I believe is a false positive since you already have TypeHandling set to none as a security measure — securecodeninja, Sep 01 '19 at 02:28

score 1 · Answer 1 · answered Oct 11 '19 at 08:17

1

The problem is with the standard Checkmarx query for c #. In this case, Checkmarx does not recognize the correction of this code. To fix it you should use CxAudit and modify this query.

answered Oct 11 '19 at 08:17

Andrew Stefaniak

11
1

5

Please [edit] this answer to explain how to modify the query and possibly also explaiin how to use CxAudit. – AdrianHHH Oct 11 '19 at 08:41
CXAudit is an product add-ons of Checkmarx. Check Checkmarx WIKI for use and more. But this is a tricky things to do, if you don't know how to – SPoint Nov 22 '19 at 10:59

Deserializing of untrusted data using C#

1 Answers1