From 23490db7e8f25e279eb763bade9eae09bb2a3db7 Mon Sep 17 00:00:00 2001 From: Genevieve Warren <24882762+gewarren@users.noreply.github.com> Date: Wed, 29 Jul 2026 09:04:24 -0700 Subject: [PATCH 1/3] fix code example --- .../code-analysis/quality-rules/ca5362.md | 61 ++++++------------- .../snippets/csharp/all-rules/ca5362.cs | 25 ++++++++ 2 files changed, 45 insertions(+), 41 deletions(-) create mode 100644 docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs diff --git a/docs/fundamentals/code-analysis/quality-rules/ca5362.md b/docs/fundamentals/code-analysis/quality-rules/ca5362.md index ca2f4d3fe40d6..ca7e18e1507e5 100644 --- a/docs/fundamentals/code-analysis/quality-rules/ca5362.md +++ b/docs/fundamentals/code-analysis/quality-rules/ca5362.md @@ -1,7 +1,7 @@ --- title: "CA5362: Potential reference cycle in deserialized object graph (code analysis)" description: Provides information about code analysis rule CA5362, including causes, how to fix violations, and when to suppress it. -ms.date: 05/15/2020 +ms.date: 07/29/2026 author: LLLXXXCCC ms.author: linche f1_keywords: @@ -16,12 +16,12 @@ f1_keywords: | **Title** | Potential reference cycle in deserialized object graph | | **Category** | [Security](security-warnings.md) | | **Fix is breaking or non-breaking** | Non-breaking | -| **Enabled by default in .NET 10** | No | -| **Applicable languages** | C# and Visual Basic | +| **Enabled by default in .NET 10** | No | +| **Applicable languages** | C# and Visual Basic | ## Cause -A class marked with the has a field or property may refer to the containing object directly or indirectly, allowing for a potential reference cycle. +A class marked with the has a field or property that might refer to the containing object directly or indirectly, allowing for a potential reference cycle. ## Rule description @@ -66,23 +66,26 @@ For more information, see [How to suppress code analysis warnings](../suppress-w ```csharp using System; -[Serializable()] -class ExampleClass +namespace ca5362 { - public ExampleClass ExampleProperty {get; set;} + [Serializable] + class ExampleClass + { + public ExampleClass ExampleField; - public int NormalProperty {get; set;} -} + public int NormalProperty { get; set; } + } -class AnotherClass -{ - // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. - public void AnotherMethod(ExampleClass ec) + class AnotherClass { - while(ec != null) + // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. + public void AnotherMethod(ExampleClass ec) { - Console.WriteLine(ec.ToString()); - ec = ec.ExampleProperty; + while (ec != null) + { + Console.WriteLine(ec.ToString()); + ec = ec.ExampleField; + } } } } @@ -90,28 +93,4 @@ class AnotherClass ### Solution -```csharp -using System; - -[Serializable()] -class ExampleClass -{ - [NonSerialized] - public ExampleClass ExampleProperty {get; set;} - - public int NormalProperty {get; set;} -} - -class AnotherClass -{ - // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. - public void AnotherMethod(ExampleClass ec) - { - while(ec != null) - { - Console.WriteLine(ec.ToString()); - ec = ec.ExampleProperty; - } - } -} -``` +:::code language="csharp" source="snippets/csharp/all-rules/ca5362.cs" id="snippet1"::: diff --git a/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs b/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs new file mode 100644 index 0000000000000..d9026eb3b7386 --- /dev/null +++ b/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs @@ -0,0 +1,25 @@ +using System; + +// +[Serializable()] +class ExampleClass +{ + [NonSerialized] + public ExampleClass ExampleField; + + public int NormalProperty {get; set;} +} + +class AnotherClass +{ + // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. + public void AnotherMethod(ExampleClass ec) + { + while(ec != null) + { + Console.WriteLine(ec.ToString()); + ec = ec.ExampleField; + } + } +} +// From 63fc30238e67a0ddbcdf8b8dd25d45ee8057babd Mon Sep 17 00:00:00 2001 From: Genevieve Warren <24882762+gewarren@users.noreply.github.com> Date: Wed, 29 Jul 2026 09:13:04 -0700 Subject: [PATCH 2/3] respond to feedback --- docs/fundamentals/code-analysis/quality-rules/ca5362.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/fundamentals/code-analysis/quality-rules/ca5362.md b/docs/fundamentals/code-analysis/quality-rules/ca5362.md index ca7e18e1507e5..89291fb3d53bc 100644 --- a/docs/fundamentals/code-analysis/quality-rules/ca5362.md +++ b/docs/fundamentals/code-analysis/quality-rules/ca5362.md @@ -78,7 +78,8 @@ namespace ca5362 class AnotherClass { - // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. + // The argument passed in could be + // `JsonConvert.DeserializeObject(untrustedData)`. public void AnotherMethod(ExampleClass ec) { while (ec != null) @@ -93,4 +94,4 @@ namespace ca5362 ### Solution -:::code language="csharp" source="snippets/csharp/all-rules/ca5362.cs" id="snippet1"::: +:::code language="csharp" source="snippets/csharp/all-rules/ca5362.cs" id="Snippet1"::: From 9d5fadd05cd35014e3bb717cbd3bbe10979e7e2b Mon Sep 17 00:00:00 2001 From: Genevieve Warren <24882762+gewarren@users.noreply.github.com> Date: Wed, 29 Jul 2026 15:06:01 -0700 Subject: [PATCH 3/3] Apply suggestions from code review Co-authored-by: Wade Pickett --- .../quality-rules/snippets/csharp/all-rules/ca5362.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs b/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs index d9026eb3b7386..9efe0955e2c12 100644 --- a/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs +++ b/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs @@ -1,13 +1,13 @@ using System; // -[Serializable()] +[Serializable] class ExampleClass { [NonSerialized] public ExampleClass ExampleField; - public int NormalProperty {get; set;} + public int NormalProperty { get; set; } } class AnotherClass @@ -15,7 +15,7 @@ class AnotherClass // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. public void AnotherMethod(ExampleClass ec) { - while(ec != null) + while (ec != null) { Console.WriteLine(ec.ToString()); ec = ec.ExampleField;