rules:
- id: insecure-fastjson-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://github.com/mgholam/fastJSON#security-warning-update
    category: security
    technology:
    - .net
    confidence: LOW
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
  message: >-
    $type extension has the potential to be unsafe, so use it with common sense and known json sources
    and not public facing
    ones to be safe
  patterns:
  - pattern-inside: |
      using fastJSON;
      ...
  - pattern: |
      new JSONParameters
      {
        BadListTypeChecking = false
      }