rules:
- id: insecure-fspickler-deserialization
  severity: WARNING
  languages:
  - C#
  metadata:
    cwe:
    - 'CWE-502: Deserialization of Untrusted Data'
    owasp:
    - A08:2017 - Insecure Deserialization
    - A08:2021 - Software and Data Integrity Failures
    references:
    - https://mbraceproject.github.io/FsPickler/tutorial.html#Disabling-Subtype-Resolution
    category: security
    technology:
    - .net
    confidence: MEDIUM
    cwe2022-top25: true
    cwe2021-top25: true
    subcategory:
    - vuln
    likelihood: LOW
    impact: HIGH
  message: >-
    The FsPickler is dangerous and is not recommended for data processing. Default configuration tend
    to insecure deserialization
    vulnerability.
  patterns:
  - pattern-inside: |
      using MBrace.FsPickler.Json;
      ...
  - pattern: |
      FsPickler.CreateJsonSerializer();