JSON deserialization settings: limiting MaxDepth to 128

Orckestra · Sep 26, 2022 · a68c838 · a68c838
1 parent 2655506
commit a68c838
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/Composite/Core/Serialization/CompositeJsonSerializer.cs b/Composite/Core/Serialization/CompositeJsonSerializer.cs
@@ -132,7 +132,8 @@ public static T Deserialize<T>(string str)
             var obj = JsonConvert.DeserializeObject<T>(str, new JsonSerializerSettings
             {
                 TypeNameHandling = TypeNameHandling.Auto,
-                Binder = CompositeSerializationBinder.Instance
+                Binder = CompositeSerializationBinder.Instance,
+                MaxDepth = 128
             });
 
             return obj;
@@ -168,7 +169,8 @@ public static T Deserialize<T>(params string[] strs)
             var obj = JsonConvert.DeserializeObject<T>(combinedObj.ToString(), new JsonSerializerSettings
             {
                 TypeNameHandling = TypeNameHandling.Auto,
-                Binder = CompositeSerializationBinder.Instance
+                Binder = CompositeSerializationBinder.Instance,
+                MaxDepth = 128
             });
 
             return obj;
@@ -184,7 +186,8 @@ public static object Deserialize(string str)
             var obj = JsonConvert.DeserializeObject(str, new JsonSerializerSettings
             {
                 TypeNameHandling = TypeNameHandling.Objects,
-                Binder = CompositeSerializationBinder.Instance
+                Binder = CompositeSerializationBinder.Instance,
+                MaxDepth = 128
             });
 
             return obj;