CA5367: Do not serialize types with pointer fields

#Cause

Pointers are not type safe, which means you cannot guarantee the correctness of the memory they point at. So, serializing types with pointer fields is a security risk, as it may allow an attacker to control the pointer.

#Rule description

This rule checks whether there’s a serializable class with a pointer field or property. Members that can’t be serialized can be a pointer, such as static members or fields marked with System.NonSerializedAttribute.

#How to fix violations

Don't use pointer types for members in a serializable class or don't serialize the members that are pointers.

#When to suppress warnings

Don't take the risk to use pointers in serializable types.

#Pseudo-code examples

#Violation

using System;

[Serializable()]
unsafe class TestClassA
{
    private int* pointer;
}

#Solution 1

using System;

[Serializable()]
unsafe class TestClassA
{
    private int i;
}

#Solution 2

using System;

[Serializable()]
unsafe class TestClassA
{
    private static int* pointer;
}