Our great sponsors
-
Any unchecked deserialization is dangerous - as you can see in this repo the same attack works on Json.NET, since you can inject a payload that performs arbitrary remote code execution.
-
MessagePack for C# (.NET, .NET Core, Unity, Xamarin)
Extremely Fast MessagePack Serializer for C#(.NET, .NET Core, Unity, Xamarin). / msgpack.org[C#]
The solution is always use a data contract serializer. Json.NET can of course be configured as such. My favorite serializer is MessagePack.
-
WorkOS
The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.
-
I'm using dual serialization for the heavily polymorphic data structures in my game - MessagePack with integer keys and union polymorphism for the wire format and local storage, and Json.NET with string keys and JsonKnownTypes polymorphism for debug output and long term persistence in RethinkDB. Here's what one of my simpler polymorphic data structures looks like. Lots of attributes but that's the price you pay I guess.
-
I'm using dual serialization for the heavily polymorphic data structures in my game - MessagePack with integer keys and union polymorphism for the wire format and local storage, and Json.NET with string keys and JsonKnownTypes polymorphism for debug output and long term persistence in RethinkDB. Here's what one of my simpler polymorphic data structures looks like. Lots of attributes but that's the price you pay I guess.
