{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/1859","repository_url":"https://api.github.com/repos/dotnet/roslyn-analyzers","labels_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/1859/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/1859/comments","events_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/1859/events","html_url":"https://github.com/dotnet/roslyn-analyzers/issues/1859","id":371246953,"node_id":"MDU6SXNzdWUzNzEyNDY5NTM=","number":1859,"title":"Configuration for deserialization security rules ","user":{"login":"dotpaul","id":38924837,"node_id":"MDQ6VXNlcjM4OTI0ODM3","avatar_url":"https://avatars2.githubusercontent.com/u/38924837?v=4","gravatar_id":"","url":"https://api.github.com/users/dotpaul","html_url":"https://github.com/dotpaul","followers_url":"https://api.github.com/users/dotpaul/followers","following_url":"https://api.github.com/users/dotpaul/following{/other_user}","gists_url":"https://api.github.com/users/dotpaul/gists{/gist_id}","starred_url":"https://api.github.com/users/dotpaul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotpaul/subscriptions","organizations_url":"https://api.github.com/users/dotpaul/orgs","repos_url":"https://api.github.com/users/dotpaul/repos","events_url":"https://api.github.com/users/dotpaul/events{/privacy}","received_events_url":"https://api.github.com/users/dotpaul/received_events","type":"User","site_admin":false},"labels":[{"id":1024336078,"node_id":"MDU6TGFiZWwxMDI0MzM2MDc4","url":"https://api.github.com/repos/dotnet/roslyn-analyzers/labels/Category-Security","name":"Category-Security","color":"c2e0c6","default":false}],"state":"open","locked":false,"assignee":{"login":"dotpaul","id":38924837,"node_id":"MDQ6VXNlcjM4OTI0ODM3","avatar_url":"https://avatars2.githubusercontent.com/u/38924837?v=4","gravatar_id":"","url":"https://api.github.com/users/dotpaul","html_url":"https://github.com/dotpaul","followers_url":"https://api.github.com/users/dotpaul/followers","following_url":"https://api.github.com/users/dotpaul/following{/other_user}","gists_url":"https://api.github.com/users/dotpaul/gists{/gist_id}","starred_url":"https://api.github.com/users/dotpaul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotpaul/subscriptions","organizations_url":"https://api.github.com/users/dotpaul/orgs","repos_url":"https://api.github.com/users/dotpaul/repos","events_url":"https://api.github.com/users/dotpaul/events{/privacy}","received_events_url":"https://api.github.com/users/dotpaul/received_events","type":"User","site_admin":false},"assignees":[{"login":"dotpaul","id":38924837,"node_id":"MDQ6VXNlcjM4OTI0ODM3","avatar_url":"https://avatars2.githubusercontent.com/u/38924837?v=4","gravatar_id":"","url":"https://api.github.com/users/dotpaul","html_url":"https://github.com/dotpaul","followers_url":"https://api.github.com/users/dotpaul/followers","following_url":"https://api.github.com/users/dotpaul/following{/other_user}","gists_url":"https://api.github.com/users/dotpaul/gists{/gist_id}","starred_url":"https://api.github.com/users/dotpaul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotpaul/subscriptions","organizations_url":"https://api.github.com/users/dotpaul/orgs","repos_url":"https://api.github.com/users/dotpaul/repos","events_url":"https://api.github.com/users/dotpaul/events{/privacy}","received_events_url":"https://api.github.com/users/dotpaul/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-10-17T20:09:20Z","updated_at":"2018-10-17T20:18:33Z","closed_at":null,"author_association":"COLLABORATOR","body":"In the features/dataflow branch, make the deserialization security rules (CA2300-CA2311) based on disallowing deserialization methods, and requiring a SerializationBinder, configurable.  That way customers can easily extend the rules.\r\n\r\nWe'll still want reasonable default configuration, of course."},"comment":{"url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/comments/430773454","html_url":"https://github.com/dotnet/roslyn-analyzers/issues/1859#issuecomment-430773454","issue_url":"https://api.github.com/repos/dotnet/roslyn-analyzers/issues/1859","id":430773454,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMDc3MzQ1NA==","user":{"login":"dotpaul","id":38924837,"node_id":"MDQ6VXNlcjM4OTI0ODM3","avatar_url":"https://avatars2.githubusercontent.com/u/38924837?v=4","gravatar_id":"","url":"https://api.github.com/users/dotpaul","html_url":"https://github.com/dotpaul","followers_url":"https://api.github.com/users/dotpaul/followers","following_url":"https://api.github.com/users/dotpaul/following{/other_user}","gists_url":"https://api.github.com/users/dotpaul/gists{/gist_id}","starred_url":"https://api.github.com/users/dotpaul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotpaul/subscriptions","organizations_url":"https://api.github.com/users/dotpaul/orgs","repos_url":"https://api.github.com/users/dotpaul/repos","events_url":"https://api.github.com/users/dotpaul/events{/privacy}","received_events_url":"https://api.github.com/users/dotpaul/received_events","type":"User","site_admin":false},"created_at":"2018-10-17T20:18:33Z","updated_at":"2018-10-17T20:18:33Z","author_association":"COLLABORATOR","body":"I'd like to use a structured configuration for this, and was thinking of using JSON.\r\n\r\nBut the analyzers are targeting .NET Standard 1.3 and DataContractJsonSerializer is only available in .NET Standard 2.0.\r\n\r\nAny chance of upgrading to .NET Standard 2.0?\r\n\r\nOtherwise I suppose I'll go with XML and use XmlReader.\r\n"}}
{"actor":{"display_login":"dotpaul"}}