Added method IsKnownExploitableType(string typeFullName)

SecureCoding.Test/SecureSerialization/KnownExploitableTypesTests.cs

@@ -0,0 +1,27 @@
+namespace SecureCoding.SecureSerialization.Tests
+{
+    using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+    [TestClass()]
+    public class KnownExploitableTypesTests
+    {
+        [DataTestMethod]
+        [DataRow("System.Data.DataSet", true)]
+        [DataRow("System.Security.Principal.WindowsIdentity", true)]
+        [DataRow("System.Management.Automation.PSObject", true)]
+        [DataRow("System.String", false)]
+        [DataRow("System.Int32", false)]
+        [DataRow("System.Collections.Generic.List`1", false)]
+        [DataRow("system.data.dataset", true)]
+        [DataRow("SYSTEM.SECURITY.PRINCIPAL.WINDOWSIDENTITY", true)]
+        [DataRow("system.management.automation.psobject", true)]
+        [DataRow("system.string", false)]
+        [DataRow("SYSTEM.INT32", false)]
+        public void IsKnownExploitableTypeTest(string typeFullName, bool expected)
+        {
+            bool actual = KnownExploitableTypes.IsKnownExploitableType(typeFullName);
+
+            Assert.AreEqual(expected, actual);
+        }
+    }
+}

SecureCoding/SecureSerialization/KnownExploitableTypes.cs

@@ -58,6 +58,29 @@ public static bool IsKnownExploitableType(this Type type)
             return Contains(type);
         }
 
+        /// <summary>
+        /// Determines whether the specified type name matches a known exploitable type.
+        /// </summary>
+        /// <param name="typeFullName">The fully qualified name of the type to check.</param>
+        /// <returns><see langword="true"/> if the specified type name matches any known exploitable type;  otherwise, <see langword="false"/>.</returns>
+        /// <exception cref="ArgumentNullException"><paramref name="typeFullName"/> is <see langword="null"/>.</exception>
+        /// <exception cref="ArgumentException"><paramref name="typeFullName"/> is empty or consists only of whitespace.</exception>
+        /// <remarks>A case-insensitive comparison of the type name is performed.</remarks>
+        public static bool IsKnownExploitableType(string typeFullName)
+        {
+            if( typeFullName is null)
+            {
+                throw new ArgumentNullException(nameof(typeFullName));
+            }
+
+            if (string.IsNullOrWhiteSpace(typeFullName))
+            {
+                throw new ArgumentException(nameof(typeFullName));
+            }
+
+return knownExploitableTypes.Exists(t => t.toLower().Contains(typeFullName.toLower()));
+        }
+
         /// <summary>
         /// Adds a new exploitable type to the list of known exploitable types, if it's not already present.
         /// </summary>