search

litedb-org / LiteDB

LiteDB - A .NET NoSQL Document Store in a single data file
http://www.litedb.org
MIT License
8.66k stars 1.25k forks source link

Added more blacklisted deserialization gadgets #2500

Closed JKamsker closed 5 months ago

JKamsker commented 5 months ago

I saw the fix for CVE-2022-23535 only contained Process but there are also alot more of them that are atleast as dangerous. I also moved it to the DefaultTypeNameBinder, in case the user wants to handle that by himself. I do not want to force the user to stay on the safe side, nudging is enough :)