diff --git a/docs/fundamentals/code-analysis/quality-rules/ca5362.md b/docs/fundamentals/code-analysis/quality-rules/ca5362.md index ca2f4d3fe40d6..89291fb3d53bc 100644 --- a/docs/fundamentals/code-analysis/quality-rules/ca5362.md +++ b/docs/fundamentals/code-analysis/quality-rules/ca5362.md @@ -1,7 +1,7 @@ --- title: "CA5362: Potential reference cycle in deserialized object graph (code analysis)" description: Provides information about code analysis rule CA5362, including causes, how to fix violations, and when to suppress it. -ms.date: 05/15/2020 +ms.date: 07/29/2026 author: LLLXXXCCC ms.author: linche f1_keywords: @@ -16,12 +16,12 @@ f1_keywords: | **Title** | Potential reference cycle in deserialized object graph | | **Category** | [Security](security-warnings.md) | | **Fix is breaking or non-breaking** | Non-breaking | -| **Enabled by default in .NET 10** | No | -| **Applicable languages** | C# and Visual Basic | +| **Enabled by default in .NET 10** | No | +| **Applicable languages** | C# and Visual Basic | ## Cause -A class marked with the has a field or property may refer to the containing object directly or indirectly, allowing for a potential reference cycle. +A class marked with the has a field or property that might refer to the containing object directly or indirectly, allowing for a potential reference cycle. ## Rule description @@ -66,23 +66,27 @@ For more information, see [How to suppress code analysis warnings](../suppress-w ```csharp using System; -[Serializable()] -class ExampleClass +namespace ca5362 { - public ExampleClass ExampleProperty {get; set;} + [Serializable] + class ExampleClass + { + public ExampleClass ExampleField; - public int NormalProperty {get; set;} -} + public int NormalProperty { get; set; } + } -class AnotherClass -{ - // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. - public void AnotherMethod(ExampleClass ec) + class AnotherClass { - while(ec != null) + // The argument passed in could be + // `JsonConvert.DeserializeObject(untrustedData)`. + public void AnotherMethod(ExampleClass ec) { - Console.WriteLine(ec.ToString()); - ec = ec.ExampleProperty; + while (ec != null) + { + Console.WriteLine(ec.ToString()); + ec = ec.ExampleField; + } } } } @@ -90,28 +94,4 @@ class AnotherClass ### Solution -```csharp -using System; - -[Serializable()] -class ExampleClass -{ - [NonSerialized] - public ExampleClass ExampleProperty {get; set;} - - public int NormalProperty {get; set;} -} - -class AnotherClass -{ - // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. - public void AnotherMethod(ExampleClass ec) - { - while(ec != null) - { - Console.WriteLine(ec.ToString()); - ec = ec.ExampleProperty; - } - } -} -``` +:::code language="csharp" source="snippets/csharp/all-rules/ca5362.cs" id="Snippet1"::: diff --git a/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs b/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs new file mode 100644 index 0000000000000..9efe0955e2c12 --- /dev/null +++ b/docs/fundamentals/code-analysis/quality-rules/snippets/csharp/all-rules/ca5362.cs @@ -0,0 +1,25 @@ +using System; + +// +[Serializable] +class ExampleClass +{ + [NonSerialized] + public ExampleClass ExampleField; + + public int NormalProperty { get; set; } +} + +class AnotherClass +{ + // The argument passed by could be `JsonConvert.DeserializeObject(untrustedData)`. + public void AnotherMethod(ExampleClass ec) + { + while (ec != null) + { + Console.WriteLine(ec.ToString()); + ec = ec.ExampleField; + } + } +} +//