I have a question in regard to insecure deserialization with the JSON.Net component.
It is my understanding that this component is safe by default unless you specify the
TypeNameHandling setting to anything except for
However, suppose you do not change the
TypeNameHandling setting (so that the default applies), will the following implementation be vulnerable to insecure deserialization (for instance, to achieve RCE)?
I'm only able to create RCE when the default
TypeNameHandling setting is changed.