title: Fortify Json Injection in .NET
body: <p>I am using Newtonsoft.Json for deserializing a json string but fortify complained that I am using unvalidated json. i then added a check using Newtonsoft.Json.Schema but it now complains even more</p>
  
  <pre><code>var schema = JsonSchema.Parse(JsonConvert.SerializeObject(typeof(T)));
  JToken token = JArray.Parse(json); -- Vulnerability
  IList&lt;string&gt; errors;
  if (token.IsValid(schema, out errors))
  {
      return JsonConvert.DeserializeObject&lt;T&gt;(json); -- Vulnerability
  }
  </code></pre>
  
  <p>Any advice on how to validate Json string?</p>
  
  <blockquote>
    <p>On line 23 of , the method DeserializeObject() writes
    unvalidated input into JSON. This call could allow an attacker to
    inject arbitrary elements or attributes into the JSON entity.</p>
  </blockquote>