diff --git a/SecureCoding.Test/SecureSerialization/KnownExploitableTypesTests.cs b/SecureCoding.Test/SecureSerialization/KnownExploitableTypesTests.cs index 373e89e..1160723 100644 --- a/SecureCoding.Test/SecureSerialization/KnownExploitableTypesTests.cs +++ b/SecureCoding.Test/SecureSerialization/KnownExploitableTypesTests.cs @@ -17,6 +17,7 @@ public class KnownExploitableTypesTests [DataRow("system.management.automation.psobject", true)] [DataRow("system.string", false)] [DataRow("SYSTEM.INT32", false)] + [DataRow("Token", false)] public void IsKnownExploitableTypeTest(string typeFullName, bool expected) { bool actual = KnownExploitableTypes.IsKnownExploitableType(typeFullName); diff --git a/SecureCoding/SecureSerialization/KnownExploitableTypes.cs b/SecureCoding/SecureSerialization/KnownExploitableTypes.cs index bbcf269..4415e71 100644 --- a/SecureCoding/SecureSerialization/KnownExploitableTypes.cs +++ b/SecureCoding/SecureSerialization/KnownExploitableTypes.cs @@ -78,7 +78,7 @@ public static bool IsKnownExploitableType(string typeFullName) throw new ArgumentException(nameof(typeFullName)); } -return knownExploitableTypes.Exists(t => t.ToLowerInvariant().Contains(typeFullName.ToLowerInvariant())); + return knownExploitableTypes.Exists(t => typeFullName.ToLowerInvariant().Contains(t.ToLowerInvariant())); } ///