adrenak / univoice-mirror-network

A Mirror based implementation for UniVoice voice network
MIT License
8 stars 0 forks source link

Microsoft has officially labelled BinaryFormatter as fundamentally insecure #1

Open Bod9001 opened 8 months ago

Bod9001 commented 8 months ago

https://learn.microsoft.com/en-gb/dotnet/standard/serialization/binaryformatter-security-guide

I did notice this was used in the project here and here, and looks like it could be relatively easily exploited to send malicious packets to the server/other clients, best to swap it out for something else.

adrenak commented 8 months ago

Oh wow. Thanks for this @Bod9001 I'm in the middle of a big refactor of univoice so I'll keep this in mind