I have a question in regard to insecure deserialization with the JSON.Net component.
It is my understanding that this component is safe by default unless you specify the TypeNameHandling
setting to anything except for none
.
However, suppose you do not change the TypeNameHandling
setting (so that the default applies), will the following implementation be vulnerable to insecure deserialization (for instance, to achieve RCE)?
JsonConvert.DeserializeObject<dynamic>(jsonModelFromUserinput)
I'm only able to create RCE when the default TypeNameHandling
setting is changed.