Fixing unsafe deserialization
Json.NET had always been a popular framework for processing JSON among .NET developers until .NET recently introduced its own set of serializer/deserializer classes under the System.Text.Json namespace. This new set of classes removes prior versions of .NET Core's dependency on the library.
Json.NET has a type-handling feature that can make your ASP.NET Core web application vulnerable to insecure deserialization if misused. The automatic type handling will allow the Json.NET stream deserializer to use the declared .NET type in an incoming request. Allowing your app to automatically deserialize objects based on the declared .NET type from an untrusted source can be harmful and may cause the instantiation of unexpected objects, causing arbitrary code execution in the host. In this recipe, we will fix this unsafe deserialization and prevent harmful automatic type handling.
Getting ready
For the recipes of this chapter, we will need the sample...
