System.Text.Json 9.0

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. C# 13112 lines · 4.2K tokens
  2. System.Text.Json 9.053 lines · 2.2K tokens
Total165 lines · 6.4K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 78
  • 79
  • 89
  • 94
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 257
  • 295
  • 323
  • 327
  • 328
  • 338
  • 362
  • 367
  • 426
  • 470
  • 488
  • 502
  • 532
  • 611
  • 636
  • 639
  • 674
  • 759
  • 770
  • 772
  • 798
  • 829
  • 862
  • 915
  • 916
  • 918
  • 922
  • 1287
  • 1333
  • 1395

Prompt Preview

Apply these rules to System.Text.Json 9.0 after the C# 13 baseline. A successfully deserialized object is still untrusted until its whole graph satisfies the application's contract and policy.

Serviced configuration

  • Keep both places System.Text.Json comes from patched: the copy in the .NET 9 shared runtime, which each runtime servicing update replaces and NuGet audit never sees, and any standalone System.Text.Json package reference, which moves only when you update it and is the copy the audit reports. Rebuild self-contained applications and container images after updates, and migrate before .NET 9 support ends on 2026-11-10.
  • Define separate, startup-built JsonSerializerOptions instances for contracts with different trust or compatibility requirements. Complete Converters and TypeInfoResolverChain, freeze the options with MakeReadOnly(), and do not mutate or select them from request data.
  • Register source-generated JsonSerializerContext contracts for the finite DTO set and disable reflection defaults with JsonSerializerIsReflectionEnabledByDefault=false when implicit reflection fallback is forbidden; independently enforce any exact runtime-type allow-list.
  • Account for the exact Web profile: JsonSerializerOptions.Web, JsonSerializerDefaults.Web, and ASP.NET Core use camel-case output, case-insensitive input matching, and JsonNumberHandling.AllowReadingFromString; these are not the stricter general defaults.

Required and unambiguous input

  • Deserialize into purpose-built input DTOs that contain only caller-writable data. Never bind