search

pwntester / ysoserial.net

Deserialization payload generator for a variety of .NET formatters
MIT License
3.18k stars 468 forks source link

Update Outdated Dependencies #121

Closed gwillcox-r7 closed 2 years ago

gwillcox-r7 commented 2 years ago

Many dependencies of this project are now long longer supported, have been removed from NuGet for the version specified, or contain security issues in the version used. It would likely be a good idea to go a run through of all of the dependencies and update the project to use more modern versions where applicable or find suitable replacements where the project is no longer maintained.

gwillcox-r7 commented 2 years ago

Note that for those encountering issues compiling this with Visual Studio 2022, there is a bug with Visual Studio 2022 where it might not come with the nuget packages for some reason. One can fix this by using dotnet nuget remove source nuget.org followed by dotnet nuget add source https://api.nuget.org/v3/index.json -n nuget.org as described at https://github.com/NuGet/Home/issues/10804#issuecomment-955630547 to fix this issue.

Whilst this will allow you to compile the project in Visual Studio 2022, I think the outstanding concerns pointed above still remain and deserve further inspection from a project maintainability standpoint.

irsdl commented 2 years ago

Whilst a few of the libraries can get updated, this project uses some vulnerable libraries intentionally to generate and test payloads for vulnerable applications. Please refer to the readme file to see what this project is all about and why most of the libraries should be kept as is.

I can compile the project without any issues using my VS2022 at the moment Microsoft Visual Studio Community 2022 (64-bit) - Current Version 17.3.0. Perhaps they have fixed the issue in their latest version.