From ccc363164dc2b533427aa0864a8f7f24e1b2bf72 Mon Sep 17 00:00:00 2001 From: Skyrunner-Dev-ops Date: Wed, 21 Oct 2026 23:49:56 +0530 Subject: [PATCH] Fix typos in BinaryFormatter migration guide --- .../serialization/binaryformatter-migration-guide/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/standard/serialization/binaryformatter-migration-guide/index.md b/docs/standard/serialization/binaryformatter-migration-guide/index.md index 15d228f739cea..ae747f9322429 100644 --- a/docs/standard/serialization/binaryformatter-migration-guide/index.md +++ b/docs/standard/serialization/binaryformatter-migration-guide/index.md @@ -25,7 +25,7 @@ You have two options to address that: ## What's the risk in using BinaryFormatter? -Any deserializer, binary or text, that allows its input to carry information about the objects to be created is a security problem waiting to happen. There is a common weakness enumeration (CWE) that describes the issue: [CWE-502 "Deserialization of Untrusted Data"](https://cwe.mitre.org/data/definitions/502.html). BinaryFormatter, included in the the initial release of .NET Framework in 2002, is such a deserializer. We also cover this in the [BinaryFormater security guide](../binaryformatter-security-guide.md). +Any deserializer, binary or text, that allows its input to carry information about the objects to be created is a security problem waiting to happen. There is a common weakness enumeration (CWE) that describes the issue: [CWE-502 "Deserialization of Untrusted Data"](https://cwe.mitre.org/data/definitions/502.html). BinaryFormatter, included in the initial release of .NET Framework in 2002, is such a deserializer. We also cover this in the [BinaryFormatter security guide](../binaryformatter-security-guide.md). Due to the known risks of using BinaryFormatter, the functionality was excluded from .NET Core 1.0. But without a clear migration path to using something safer, customer demand led to BinaryFormatter being included in .NET Core 2.0. Since then, the .NET team has been on the path to removing BinaryFormatter, slowly turning it off by default in multiple project types but letting consumers opt-in via flags if still needed for backward compatibility.