From e6aadc4a746fc4a22d30770964ea6ba5c895a1b7 Mon Sep 17 00:00:00 2001
From: Tson-optimizely <TrongSon.Nguyen@optimizely.com>
Date: Tue, 15 Sep 2026 14:52:54 +0700
Subject: [PATCH] Fix vulnerability CWE-502 unsafe deserialization typename
 handle

Fix: CMS-55588
---
 .../Events/EventMessageSerializationBinder.cs | 39 +++++++++++++++++++
 .../Events/MessageSerializer.cs               |  3 +-
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 src/EPiServer.Amazon/Events/EventMessageSerializationBinder.cs

diff --git a/src/EPiServer.Amazon/Events/EventMessageSerializationBinder.cs b/src/EPiServer.Amazon/Events/EventMessageSerializationBinder.cs
new file mode 100644
index 0000000..4892e36
--- /dev/null
+++ b/src/EPiServer.Amazon/Events/EventMessageSerializationBinder.cs
@@ -0,0 +1,39 @@
+using EPiServer.Events;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Serialization;
+using System;
+
+namespace EPiServer.Amazon.Events
+{
+    /// <summary>
+    /// Restricts <see cref="TypeNameHandling"/> deserialization of <see cref="EventMessage"/> payloads to a
+    /// known safe set of types, to prevent arbitrary type instantiation (CWE-502) from untrusted SNS/SQS messages.
+    /// </summary>
+    internal class EventMessageSerializationBinder : DefaultSerializationBinder
+    {
+        public override Type BindToType(string assemblyName, string typeName)
+        {
+            var type = base.BindToType(assemblyName, typeName);
+
+            if (!IsAllowed(type))
+            {
+                throw new JsonSerializationException($"Deserialization of type '{type}' is not allowed.");
+            }
+
+            return type;
+        }
+
+        private static bool IsAllowed(Type type)
+        {
+            if (type == typeof(BoxedValue<Guid>))
+            {
+                return true;
+            }
+
+            // Only types owned by EPiServer/Optimizely assemblies are trusted for polymorphic deserialization.
+            var assemblyName = type.Assembly.GetName().Name ?? string.Empty;
+            return assemblyName.Equals("EPiServer.Events", StringComparison.Ordinal)
+                || assemblyName.StartsWith("EPiServer.Events.", StringComparison.Ordinal);
+        }
+    }
+}
diff --git a/src/EPiServer.Amazon/Events/MessageSerializer.cs b/src/EPiServer.Amazon/Events/MessageSerializer.cs
index 5965c8a..4173c93 100644
--- a/src/EPiServer.Amazon/Events/MessageSerializer.cs
+++ b/src/EPiServer.Amazon/Events/MessageSerializer.cs
@@ -14,7 +14,8 @@ public class MessageSerializer
         {
             TypeNameHandling = TypeNameHandling.Auto,
             NullValueHandling = NullValueHandling.Ignore,
-            ContractResolver = new MessageContractResolver()
+            ContractResolver = new MessageContractResolver(),
+            SerializationBinder = new EventMessageSerializationBinder()
         };
 
         /// <summary>