Javascriptserializer Resolver

Vulnerable vs. safe

var js = new JavaScriptSerializer(new SimpleTypeResolver());

var js = new JavaScriptSerializer(null);

Why it matters & how to fix it

JavaScriptSerializer is constructed with a JavaScriptTypeResolver (e.g. SimpleTypeResolver), which resolves and instantiates CLR types named in the JSON payload and enables deserialization RCE on untrusted input (CWE-502). Deserialize without a type resolver, or migrate to System.Text.Json with an allow-list of expected types.

References

• https://cwe.mitre.org/data/definitions/502.html
• https://learn.microsoft.com/en-us/dotnet/api/system.web.script.serialization.javascriptserializer

Related checks

• JavaScript / TypeScript - Insecure Deserialization
  Node Serialize Unserialize
• JavaScript / TypeScript - Insecure Deserialization
  YAML Unsafe Load
• Python - Insecure Deserialization
  Jsonpickle Decode
• Python - Insecure Deserialization
  Pickle Load
• Python - Insecure Deserialization
  YAML Unsafe Load
• Java - Insecure Deserialization
  Jackson Default Typing