ysoserial.net VS JsonKnownTypes

Any unchecked deserialization is dangerous - as you can see in this repo the same attack works on Json.NET, since you can inject a payload that performs arbitrary remote code execution.

So if you have some type within your application that does something sensitive or disruptive in its constructor, an attacker can craft a stream of bytes that asks the application to create that type. From there, all kinds of crazy things can happen. Here's a privilege escalation exploit discovered in Docker for Windows that relied on BinaryFormatter. Digging into some things he mentioned I found an entire exploit suite for .NET serialization. Through very clever tricks, it creates types that, when deserialized, will execute commands. That's a big deal.

I'm using dual serialization for the heavily polymorphic data structures in my game - MessagePack with integer keys and union polymorphism for the wire format and local storage, and Json.NET with string keys and JsonKnownTypes polymorphism for debug output and long term persistence in RethinkDB. Here's what one of my simpler polymorphic data structures looks like. Lots of attributes but that's the price you pay I guess.