Default MVC input formatter to UntrustedData for CWE-1188

AArnott · AArnott · commit f077798ea399 · 2026-05-15T10:07:06.000-06:00
MessagePackInputFormatter handles HTTP request bodies, but its default/null options path fell back to MessagePackSerializerOptions.Standard and therefore TrustedData. That left hash-based model binding without the untrusted-data collision-resistance defaults expected at this trust boundary.

Default null input-formatter options to Standard.WithSecurity(UntrustedData), while preserving caller-supplied options. Add a regression test that verifies the parameterless formatter deserializes dictionary request bodies with the collision-resistant comparer.
diff --git a/src/MessagePack.AspNetCoreMvcFormatter/MessagePackInputFormatter.cs b/src/MessagePack.AspNetCoreMvcFormatter/MessagePackInputFormatter.cs
@@ -9,16 +9,17 @@ namespace MessagePack.AspNetCoreMvcFormatter
     public class MessagePackInputFormatter : InputFormatter
     {
         private const string ContentType = "application/x-msgpack";
-        private readonly MessagePackSerializerOptions? options;
+        private static readonly MessagePackSerializerOptions DefaultOptions = MessagePackSerializerOptions.Standard.WithSecurity(MessagePackSecurity.UntrustedData);
+        private readonly MessagePackSerializerOptions options;
 
         public MessagePackInputFormatter()
-            : this(null)
+            : this(DefaultOptions)
         {
         }
 
         public MessagePackInputFormatter(MessagePackSerializerOptions? options)
         {
-            this.options = options;
+            this.options = options ?? DefaultOptions;
 
             SupportedMediaTypes.Add(ContentType);
         }
diff --git a/tests/MessagePack.AspNetCoreMvcFormatter.Tests/AspNetCoreMvcFormatterTest.cs b/tests/MessagePack.AspNetCoreMvcFormatter.Tests/AspNetCoreMvcFormatterTest.cs
@@ -2,6 +2,7 @@
 // Licensed under the MIT license. See LICENSE file in the project root for full license information.
 
 using System;
+using System.Collections.Generic;
 using System.IO;
 using System.Text;
 using System.Threading;
@@ -195,6 +196,34 @@ public void MessagePackInputFormatterSupportsXMsgPack()
             inputFormatter.SupportedMediaTypes.Is(MsgPackContentType);
         }
 
+        [Fact]
+        public async Task MessagePackInputFormatterDefaultsToUntrustedData()
+        {
+            const long value1 = 0x100000001;
+            const long value2 = 0x200000002;
+
+            var messagePackBinary = MessagePackSerializer.Serialize(new Dictionary<long, int>
+            {
+                [value1] = 1,
+                [value2] = 2,
+            });
+
+            var httpContext = new DefaultHttpContext();
+            httpContext.Features.Set<IHttpResponseFeature>(new TestResponseFeature());
+            httpContext.Request.Body = new NonSeekableReadStream(messagePackBinary);
+            httpContext.Request.ContentType = MsgPackContentType;
+
+            InputFormatterContext inputFormatterContext = this.CreateInputFormatterContext(typeof(Dictionary<long, int>), httpContext);
+            var inputFormatter = new MessagePackInputFormatter();
+
+            InputFormatterResult result = await inputFormatter.ReadAsync(inputFormatterContext);
+
+            Assert.False(result.HasError);
+            var dictionary = Assert.IsType<Dictionary<long, int>>(result.Model);
+            Assert.Equal(EqualityComparer<long>.Default.GetHashCode(value1), EqualityComparer<long>.Default.GetHashCode(value2));
+            Assert.NotEqual(dictionary.Comparer.GetHashCode(value1), dictionary.Comparer.GetHashCode(value2));
+        }
+
         /// <summary>
         /// <see href="https://github.com/aspnet/Mvc/blob/master/test/Microsoft.AspNetCore.Mvc.Formatters.Json.Test/JsonOutputFormatterTests.cs#L453">JsonOutputFormatterTests.cs#L453</see>.
         /// </summary>

Original file line number	Diff line number	Diff line change
`@@ -9,16 +9,17 @@ namespace MessagePack.AspNetCoreMvcFormatter`
`9`	`9`	`public class MessagePackInputFormatter : InputFormatter`
`10`	`10`	`{`
`11`	`11`	`private const string ContentType = "application/x-msgpack";`
`12`		`- private readonly MessagePackSerializerOptions? options;`
	`12`	`+ private static readonly MessagePackSerializerOptions DefaultOptions = MessagePackSerializerOptions.Standard.WithSecurity(MessagePackSecurity.UntrustedData);`
	`13`	`+ private readonly MessagePackSerializerOptions options;`
`13`	`14`
`14`	`15`	`public MessagePackInputFormatter()`
`15`		`- : this(null)`
	`16`	`+ : this(DefaultOptions)`
`16`	`17`	`{`
`17`	`18`	`}`
`18`	`19`
`19`	`20`	`public MessagePackInputFormatter(MessagePackSerializerOptions? options)`
`20`	`21`	`{`
`21`		`- this.options = options;`
	`22`	`+ this.options = options ?? DefaultOptions;`
`22`	`23`
`23`	`24`	`SupportedMediaTypes.Add(ContentType);`
`24`	`25`	`}`