CA2355: Unsafe DataSet or DataTable in deserialized object graph

#Cause

Deserializing when the casted or specified type's object graph can include a System.Data.DataSet or System.Data.DataTable.

This rule uses a different approach to a similar rule, CA2353: Unsafe DataSet or DataTable in serializable type.

The casted or specified type is evaluated when:

• Initializing a System.Runtime.Serialization.DataContractSerializer object
• Initializing a System.Runtime.Serialization.Json.DataContractJsonSerializer object
• Initializing an System.Xml.Serialization.XmlSerializer object
• Invoking System.Web.Script.Serialization.JavaScriptSerializer.Deserialize
• Invoking System.Web.Script.Serialization.JavaScriptSerializer.DeserializeObject
• Invoking System.Xml.Serialization.XmlSerializer.FromTypes
• Invoking Newtonsoft Json.NET JsonSerializer.Deserialize
• Invoking Newtonsoft Json.NET JsonConvert.DeserializeObject

#Rule description

When deserializing untrusted input with System.Runtime.Serialization.Formatters.Binary.BinaryFormatter and the deserialized object graph contains a System.Data.DataSet or System.Data.DataTable, an attacker can craft a malicious payload to perform a denial of service attack. There may be unknown remote code execution vulnerabilities.

For more information, see DataSet and DataTable security guidance.

#How to fix violations

• If possible, use Entity Framework rather than System.Data.DataSet and System.Data.DataTable.
• Make the serialized data tamper-proof. After serialization, cryptographically sign the serialized data. Before deserialization, validate the cryptographic signature. Protect the cryptographic key from being disclosed and design for key rotations.

#When to suppress warnings

#author: dotpaul ms.author: paulming ms.date: 04/17/2019 ms.topic: include

It's safe to suppress a warning from this rule if:

• You know the input is trusted. Consider that your application's trust boundary and data flows may change over time.
• You've taken one of the precautions in How to fix violations.

#Suppress a warning

If you just want to suppress a single violation, add preprocessor directives to your source file to disable and then re-enable the rule.

#pragma warning disable CA2355
// The code that's violating the rule is on this line.
#pragma warning restore CA2355

To disable the rule for a file, folder, or project, set its severity to none in the configuration file.

[*.{cs,vb}]
dotnet_diagnostic.CA2355.severity = none

For more information, see How to suppress code analysis warnings.

#Pseudo-code examples

#Violation

using System.Data;
using System.IO;
using System.Runtime.Serialization;

[Serializable]
public class MyClass
{
    public MyOtherClass OtherClass { get; set; }
}

[Serializable]
public class MyOtherClass
{
    private DataSet myDataSet;
}

public class ExampleClass
{
    public MyClass Deserialize(Stream stream)
    {
        BinaryFormatter bf = new BinaryFormatter();
        return (MyClass) bf.Deserialize(stream);
    }
}

#Related rules

CA2350: Ensure DataTable.ReadXml()'s input is trusted

CA2351: Ensure DataSet.ReadXml()'s input is trusted

CA2352: Unsafe DataSet or DataTable in serializable type can be vulnerable to remote code execution attacks

CA2353: Unsafe DataSet or DataTable in serializable type

CA2354: Unsafe DataSet or DataTable in deserialized object graph can be vulnerable to remote code execution attack

CA2356: Unsafe DataSet or DataTable in web deserialized object graph

CA2361: Ensure autogenerated class containing DataSet.ReadXml() is not used with untrusted data

CA2362: Unsafe DataSet or DataTable in autogenerated serializable type can be vulnerable to remote code execution attacks