Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Series
.NET Core Web API
36
Angular
31
JavaScript Basics
19
JavaScript Intermediate
18
JavaScript Advanced
16
TypeScript Basics
14
TypeScript Intermediate
14
TypeScript Advanced
12
Entity Framework Core
28
Dapper
16
Git & GitHub
29
Web Security (OWASP Top 10)
21
LLM Fundamentals
20
C# Fundamentals
20
Object-Oriented Programming in C#
16
C# Collections and Generics
11
LINQ
17
Asynchronous Programming in C#
17
Advanced C#
14
C# Versions
6
Solution Patterns
22
2 posts found
#deserialization
Security
PART 18
OWASP Top 10:2017: XXE, Insecure Deserialization and the Lessons That Remain
We look at the OWASP Top 10:2017 list, the web it was written for and what changed from 2013 to 2017. We see with a real request how .NET 10 rejects XXE by default, show in code why BinaryFormatter no longer compiles or runs, and compare the years when XSS had its own category with today's list.
6 Nov 2026
8 min
10
Security
PART 14
OWASP A08: Software or Data Integrity Failures — Deserialization and Mass Assignment
We explain conceptually why letting incoming data choose its own type is dangerous, and show with real output how BinaryFormatter ends on net10.0 with a build error and a PlatformNotSupportedException. We set up allow-list polymorphism in System.Text.Json, close mass assignment with DTOs and JsonUnmappedMemberHandling, and look at code integrity through CI/CD and SRI.
6 Nov 2026
9 min
12