a deserializer

edvraa · edvraa · commit 0590522e4bb3 · 2021-04-21T13:29:00.000+03:00
diff --git a/csharp/ql/src/semmle/code/csharp/serialization/Deserializers.qll b/csharp/ql/src/semmle/code/csharp/serialization/Deserializers.qll
@@ -87,7 +87,7 @@ class UnsafeDeserializerCallable extends Callable {
   }
 }
 
-/** Deserializer exploitable only if user controls the expected object type. */
+/** A deserializer exploitable only if user controls the expected object type. */
 class StrongTypeDeserializer extends Class {
   StrongTypeDeserializer() {
     this instanceof XmlSerializerClass
@@ -100,7 +100,7 @@ class StrongTypeDeserializer extends Class {
   }
 }
 
-/** Deserializer that doesn't make strong expected type check. */
+/** A deserializer that doesn't make strong expected type check. */
 class WeakTypeDeserializer extends Class {
   WeakTypeDeserializer() {
     this instanceof BinaryFormatterClass

Original file line number	Diff line number	Diff line change
`@@ -87,7 +87,7 @@ class UnsafeDeserializerCallable extends Callable {`
`87`	`87`	`}`
`88`	`88`	`}`
`89`	`89`
`90`		`-/** Deserializer exploitable only if user controls the expected object type. */`
	`90`	`+/** A deserializer exploitable only if user controls the expected object type. */`
`91`	`91`	`class StrongTypeDeserializer extends Class {`
`92`	`92`	`StrongTypeDeserializer() {`
`93`	`93`	`this instanceof XmlSerializerClass`
`@@ -100,7 +100,7 @@ class StrongTypeDeserializer extends Class {`
`100`	`100`	`}`
`101`	`101`	`}`
`102`	`102`
`103`		`-/** Deserializer that doesn't make strong expected type check. */`
	`103`	`+/** A deserializer that doesn't make strong expected type check. */`
`104`	`104`	`class WeakTypeDeserializer extends Class {`
`105`	`105`	`WeakTypeDeserializer() {`
`106`	`106`	`this instanceof BinaryFormatterClass`