README.md

Deserializing the untrusted data is dangerous

This tiny library tries to fix several known BinaryFormatter vulnerabilities.
See ysoserial.net project for details.

Code sample

// bad: deserialization can trigger arbitrary code execution
var fmt = new BinaryFormatter();
var object = fmt.Deserialize(stream);

// better: deserialization is checked against known vulnerabilities
var fmt = new BinaryFormatter();
fmt.Binder = new SafeSerializationBinder();
var object = fmt.Deserialize(stream);

Usage

TODO: publish a Nuget package