Skip to content

Conversation

@GrabYourPitchforks
Copy link
Member

@GrabYourPitchforks GrabYourPitchforks commented Nov 12, 2024

Summary

Reworded a portion of the BinaryFormatter security guide after consultation with the security LT.

  • Removed the word "vulnerability" from a key paragraph. We document that BF is only intended to be used with trusted input, so we would not consider any undesired behavior caused by passing untrusted input to it to be a vulnerability.
  • Clarified that the .NET team is not committed to making code changes in response to binder bypasses or other exploits. The previous wording was somewhat ambiguous and could have been incorrectly interpreted as that .NET will still try to make code changes except when impractical to do so.

Internal previews

📄 File 🔗 Preview link
docs/standard/serialization/binaryformatter-security-guide.md Deserialization risks in use of BinaryFormatter and related types

Copy link
Contributor

@gewarren gewarren left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left some style suggestions.

Co-authored-by: Genevieve Warren <[email protected]>
@GrabYourPitchforks GrabYourPitchforks merged commit ef0876b into main Nov 13, 2024
8 checks passed
@GrabYourPitchforks GrabYourPitchforks deleted the levib/bf-security-guide branch November 13, 2024 01:19
@GrabYourPitchforks
Copy link
Member Author

Thanks for the feedback! :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants