Zennoxa Shield
Rules / C#
SHIELD-CSHARP-007

Insecure deserialization via Json.NET TypeNameHandling

criticalC#CWE-502CVSS 9.8

What it detects

Json.NET is configured with TypeNameHandling.All or Auto, enabling type-confusion deserialization attacks.

How to fix

Set TypeNameHandling to None or use a strict SerializationBinder that allowlists safe types.

Vulnerable — Shield flags thisMessageParser.cs
using Newtonsoft.Json;

public class MessageParser
{
    public Order Parse(string json)
    {
        var settings = new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All };
        return JsonConvert.DeserializeObject<Order>(json, settings);
    }
}
Fixed — scans cleanMessageParser.cs
using Newtonsoft.Json;

public class MessageParser
{
    public Order Parse(string json)
    {
        var settings = new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.None };
        return JsonConvert.DeserializeObject<Order>(json, settings);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-007, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-007: Insecure deserialization via Json.NET TypeNameHandling — Zennoxa Shield