kubemq-io / kubemq-CSharp

C# Library for KubeMQ server
MIT License
30 stars 8 forks source link

Insecure Extensive use of BinaryFormatter #17

Open Jab0rnal opened 2 years ago

Jab0rnal commented 2 years ago

When attempting to implement this library, I have been getting the following error message:

Exception thrown: 'System.NotSupportedException' in System.Runtime.Serialization.Formatters.dll
BinaryFormatter serialization and deserialization are disabled within this application.

The implementation here is using an unsecure method of binary serialization for serializing event bodies, as described here:

https://docs.microsoft.com/en-gb/dotnet/standard/serialization/binaryformatter-security-guide

A list of "preferred alternatives" are described in the document.

kubemq commented 1 year ago

Please check with the latest version v1.6.0