Skip to content

Commit

Permalink
Use safe default settings for Newtonsoft.Json 12.X and below
Browse files Browse the repository at this point in the history
Setting `JsonSerializerSettings.MaxDepth` manually for custom serializing options to avoid requiring to upgrade Newtonsoft.Json to 13.0.1 version where GHSA-5crp-9r3c-p9vr is not present.
Relates to #2468
  • Loading branch information
odinserj committed Nov 26, 2024
1 parent 484594c commit bc48bae
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions src/Hangfire.Core/Common/SerializationHelper.cs
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,7 @@ internal static JsonSerializerSettings GetInternalSettings()
serializerSettings.DefaultValueHandling = DefaultValueHandling.IgnoreAndPopulate;
serializerSettings.NullValueHandling = NullValueHandling.Ignore;
serializerSettings.CheckAdditionalContent = true; // Default option in JsonConvert.Deserialize method
serializerSettings.MaxDepth = 128;
#if NETSTANDARD2_0
serializerSettings.SerializationBinder = new TypeHelperSerializationBinder();
#else
Expand All @@ -234,6 +235,7 @@ private static JsonSerializerSettings GetLegacyTypedSerializerSettings()
{
var serializerSettings = new JsonSerializerSettings();
serializerSettings.TypeNameHandling = TypeNameHandling.Objects;
serializerSettings.MaxDepth = 128;

SetSimpleTypeNameAssemblyFormat(serializerSettings);

Expand Down

0 comments on commit bc48bae

Please sign in to comment.