Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 21 additions & 41 deletions docs/fundamentals/code-analysis/quality-rules/ca5362.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: "CA5362: Potential reference cycle in deserialized object graph (code analysis)"
description: Provides information about code analysis rule CA5362, including causes, how to fix violations, and when to suppress it.
ms.date: 05/15/2020
ms.date: 07/29/2026
author: LLLXXXCCC
ms.author: linche
f1_keywords:
Expand All @@ -16,12 +16,12 @@ f1_keywords:
| **Title** | Potential reference cycle in deserialized object graph |
| **Category** | [Security](security-warnings.md) |
| **Fix is breaking or non-breaking** | Non-breaking |
| **Enabled by default in .NET 10** | No |
| **Applicable languages** | C# and Visual Basic |
| **Enabled by default in .NET 10** | No |
| **Applicable languages** | C# and Visual Basic |

## Cause

A class marked with the <xref:System.SerializableAttribute?displayProperty=fullName> has a field or property may refer to the containing object directly or indirectly, allowing for a potential reference cycle.
A class marked with the <xref:System.SerializableAttribute?displayProperty=fullName> has a field or property that might refer to the containing object directly or indirectly, allowing for a potential reference cycle.

## Rule description

Expand Down Expand Up @@ -66,52 +66,32 @@ For more information, see [How to suppress code analysis warnings](../suppress-w
```csharp
using System;

[Serializable()]
class ExampleClass
namespace ca5362
{
public ExampleClass ExampleProperty {get; set;}
[Serializable]
class ExampleClass
{
public ExampleClass ExampleField;

public int NormalProperty {get; set;}
}
public int NormalProperty { get; set; }
}

class AnotherClass
{
// The argument passed by could be `JsonConvert.DeserializeObject<ExampleClass>(untrustedData)`.
public void AnotherMethod(ExampleClass ec)
class AnotherClass
{
while(ec != null)
// The argument passed in could be
// `JsonConvert.DeserializeObject<ExampleClass>(untrustedData)`.
public void AnotherMethod(ExampleClass ec)
{
Console.WriteLine(ec.ToString());
ec = ec.ExampleProperty;
while (ec != null)
{
Console.WriteLine(ec.ToString());
ec = ec.ExampleField;
}
}
}
}
```

### Solution

```csharp
using System;

[Serializable()]
class ExampleClass
{
[NonSerialized]
public ExampleClass ExampleProperty {get; set;}

public int NormalProperty {get; set;}
}

class AnotherClass
{
// The argument passed by could be `JsonConvert.DeserializeObject<ExampleClass>(untrustedData)`.
public void AnotherMethod(ExampleClass ec)
{
while(ec != null)
{
Console.WriteLine(ec.ToString());
ec = ec.ExampleProperty;
}
}
}
```
:::code language="csharp" source="snippets/csharp/all-rules/ca5362.cs" id="Snippet1":::
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
using System;

// <Snippet1>
[Serializable]
class ExampleClass
{
[NonSerialized]
public ExampleClass ExampleField;

Check warning on line 8 in docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs

View workflow job for this annotation

GitHub Actions / snippets-build

Field 'ExampleClass.ExampleField' is never assigned to, and will always have its default value null

Check warning on line 8 in docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs

View workflow job for this annotation

GitHub Actions / snippets-build

Non-nullable field 'ExampleField' must contain a non-null value when exiting constructor. Consider adding the 'required' modifier or declaring the field as nullable.

public int NormalProperty { get; set; }
}

class AnotherClass
{
// The argument passed by could be `JsonConvert.DeserializeObject<ExampleClass>(untrustedData)`.
public void AnotherMethod(ExampleClass ec)
{
while (ec != null)
{
Console.WriteLine(ec.ToString());
ec = ec.ExampleField;
}
}
}
// </Snippet1>
Loading