search

mbdavid / LiteDB

LiteDB - A .NET NoSQL Document Store in a single data file
http://www.litedb.org
MIT License
8.35k stars 1.22k forks source link

Added more blacklisted deserialization gadgets #2500

Closed JKamsker closed 1 week ago

JKamsker commented 3 weeks ago

I saw the fix for CVE-2022-23535 only contained Process but there are also alot more of them that are atleast as dangerous. I also moved it to the DefaultTypeNameBinder, in case the user wants to handle that by himself. I do not want to force the user to stay on the safe side, nudging is enough :)