Files
codeql/csharp/ql/test/query-tests/Security Features/CWE-502/UnsafeDeserializationUntrustedInput/XmlObjectSerializerUntrustedInputBad.cs
2021-03-20 21:50:46 +02:00

16 lines
414 B
C#

using System.Web.UI.WebControls;
using System.Runtime.Serialization;
using System.IO;
using System.Text;
using System;
class BadXmlObjectSerializer
{
public static object Deserialize(TextBox type, TextBox data)
{
XmlObjectSerializer ds = new DataContractSerializer(Type.GetType(type.Text));
// BAD
return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text)));
}
}