rules:
- id: data-contract-resolver
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide
    category: security
    technology:
    - .net
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
  message: >-
    Only use DataContractResolver if you are completely sure of what information is being serialized.
    Malicious types can cause unexpected behavior.
  patterns:
  - pattern: |
      class $MYDCR : DataContractResolver { ... }