Xmlserializer Dynamic Type

Vulnerable vs. safe

var xs = new XmlSerializer(Type.GetType(typeName));

var xs = new XmlSerializer(typeof(string));

Why it matters & how to fix it

An XmlSerializer is built for a Type resolved at runtime via Type.GetType, so an attacker who influences the type name can drive instantiation of unexpected types during deserialization (CWE-502). Bind the serializer to a fixed, compile-time type and validate/allow-list any caller-supplied type discriminator.

References

• https://cwe.mitre.org/data/definitions/502.html
• https://learn.microsoft.com/en-us/dotnet/api/system.xml.serialization.xmlserializer

Related checks

• JavaScript / TypeScript - Insecure Deserialization
  Node Serialize Unserialize
• JavaScript / TypeScript - Insecure Deserialization
  YAML Unsafe Load
• Python - Insecure Deserialization
  Jsonpickle Decode
• Python - Insecure Deserialization
  Pickle Load
• Python - Insecure Deserialization
  YAML Unsafe Load
• Java - Insecure Deserialization
  Jackson Default Typing