Blog

Mert Özen's blog posts on software development, backend, frontend, and DevOps.

Series

.NET Core Web API 36 Angular 31 JavaScript Basics 19 JavaScript Intermediate 18 JavaScript Advanced 16 TypeScript Basics 14 TypeScript Intermediate 14 TypeScript Advanced 12 Entity Framework Core 28 Dapper 16 Git & GitHub 29 Web Security (OWASP Top 10) 21 LLM Fundamentals 20

2 posts found #deserialization

Newest Oldest Popular

Security PART 18

OWASP Top 10:2017: XXE, Insecure Deserialization and the Lessons That Remain

We look at the OWASP Top 10:2017 list, the web it was written for and what changed from 2013 to 2017. We see with a real request how .NET 10 rejects XXE by default, show in code why BinaryFormatter no longer compiles or runs, and compare the years when XSS had its own category with today's list.

6 Nov 2026 8 min 8

Security PART 14

OWASP A08: Software or Data Integrity Failures — Deserialization and Mass Assignment

We explain conceptually why letting incoming data choose its own type is dangerous, and show with real output how BinaryFormatter ends on net10.0 with a build error and a PlatformNotSupportedException. We set up allow-list polymorphism in System.Text.Json, close mass assignment with DTOs and JsonUnmappedMemberHandling, and look at code integrity through CI/CD and SRI.

6 Nov 2026 9 min 8