4 ms·
This uses the package H.Pipes which seems to use System.Runtime.Serialization.BinaryFormatter by default; isn't this insecure?
by resoluteteeth 5y ago
This uses the package H.Pipes which seems to use System.Runtime.Serialization.BinaryFormatter by default; isn't this insecure?
- tonyedgecombe 5y agoWhy is BinaryFormatter insecure? Edit: Never mind, see https://docs.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-security-guide https://docs.microsoft.com/en-us/dotnet/standard/serializati...
- entrep 5y agoIt's possible to use different formatters for H.Pipes. I will probably update the post to not mislead.
- HappySweeney 5y agoI've recently done something close to this, and found Ceras[0] to be an excellent choice for the serialization layer. [0] https://github.com/rikimaru0345/Ceras https://github.com/rikimaru0345/Ceras
- havendv 5y agoI added a package for Ceras: https://www.nuget.org/packages/H.Formatters.Ceras/ https://www.nuget.org/packages/H.Formatters.Ceras/ I ran into some issues in testing where the data hash after serialization/deserialization does not match for Ceras. I added the package anyway, but this needs to be used with caution.