mirror of
https://github.com/github/codeql.git
synced 2025-12-17 01:03:14 +01:00
16 lines
468 B
C#
16 lines
468 B
C#
using System.Web.UI.WebControls;
|
|
using System.Runtime.Serialization;
|
|
using System.IO;
|
|
using System.Text;
|
|
using System;
|
|
|
|
class BadXmlObjectSerializer
|
|
{
|
|
public static object Deserialize(TextBox type, TextBox data)
|
|
{
|
|
XmlObjectSerializer ds = new DataContractSerializer(Type.GetType(type.Text));
|
|
// BAD
|
|
return ds.ReadObject(new MemoryStream(Encoding.UTF8.GetBytes(data.Text))); // $ Alert[cs/unsafe-deserialization-untrusted-input]
|
|
}
|
|
}
|