Unsafe Object Deserialization

[erik75269]

SummerBatch core contains code which deserializes object via instantiating a BinaryFormatter. It may be vulnerable to other attack categories, such as information disclosure or remote code execution.

[erik75269]

Problem solved with Commit:0409ce1

[erik75269]

After serialization and deserialization, it requires to add appsettings.json in the project and setting up the assemblyName(support prefix-name and full name) for where the type defined.

[erik75269]

Please be sure to select the 'Copy Always' option in 'Copy to Output Directory' for the file appsettings.json. (default is 'Do not copy' which will cause runtime issues)

appsettings.json:
…
{
"Deserialization": {
"assemblyName": [
"com.myassembly",
"com.assembly.other.*"
]
}
}
…