SerializationBinder

我就来跟一下这个SerializationBinder吧写一下流程说明一下Binder使用不当造成绕过

Binder和java中的那个resovleclass过滤黑名单差不多

.Net中是使用Binder来进行过滤的

Demo

using System;
using System.IO;
using System.Runtime.Serialization;
using System.Runtime.Serialization.Formatters.Binary;

namespace Serialize
{
    internal class Program
    {
        static void Main(string[] args)
        {
            BinaryFormatter binaryFormatter = new BinaryFormatter();
            MemoryStream memoryStream = new MemoryStream();
            RCE calc = new RCE("calc");
            binaryFormatter.Serialize(memoryStream, calc);


            memoryStream.Position = 0;
            binaryFormatter.Binder = new MyBinder();
            object v = binaryFormatter.Deserialize(memoryStream);
            Console.WriteLine(v);
            Console.ReadKey();
        }
    }

    [Serializable]
    class RCE
    {
        public string cmd;

        public RCE(string cmd)
        {
            this.cmd = cmd;
        }

        public override string ToString()
        {
            return $"exec cmd:{cmd}";
        }
    }
    class MyBinder : SerializationBinder
    {
        public override Type BindToType(string assemblyName, string typeName)
        {
            Console.WriteLine($"assemblyName:{assemblyName},typeName:{typeName}.");
            Type typeToDeserialize = Type.GetType(String.Format("{0}, {1}", typeName, assemblyName));

            if (typeToDeserialize.Equals(typeof(RCE)))
            {
                //throw new Exception("can't deseriliza rce class.");
                Console.WriteLine("can't deseriliza rce class.");
                return null;
            }
            return typeToDeserialize;
        }
    }
}