Zennoxa Shield
Rules / C#
SHIELD-CSHARP-008

Insecure deserialization via JavaScriptSerializer SimpleTypeResolver

highC#CWE-502CVSS 8.1

What it detects

JavaScriptSerializer is constructed with a SimpleTypeResolver, permitting arbitrary type deserialization.

How to fix

Construct JavaScriptSerializer without a type resolver or migrate to System.Text.Json.

Vulnerable — Shield flags thisLegacyApiHandler.cs
using System.Web.Script.Serialization;

public class LegacyApiHandler
{
    public Order Parse(string json)
    {
        var serializer = new JavaScriptSerializer(new SimpleTypeResolver());
        return serializer.Deserialize<Order>(json);
    }
}
Fixed — scans cleanLegacyApiHandler.cs
using System.Web.Script.Serialization;

public class LegacyApiHandler
{
    public Order Parse(string json)
    {
        var serializer = new JavaScriptSerializer();
        return serializer.Deserialize<Order>(json);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-008, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-008: Insecure deserialization via JavaScriptSerializer SimpleTypeResolver — Zennoxa Shield