JSON DeserializeObject method security vulnerability

[nszeitli]

Was just running some static analysis on your codebase using Pumascan and it was flagged that there could be an issue with the DeserializeObject method in SpotifyWebAPI.cs.

More details here: https://www.pumascan.com/rules/#sec0030-deserialization-newtonsoft-json

[JohnnyCrazy]

Thanks for the report 👍

From the JSON .NET Docs:

TypeNameHandling should be used with caution when your application deserializes JSON from an external source. Incoming types should be validated with a custom SerializationBinder when deserializing with a value other than None.

We're not deserializing any kind of user input, only spotify responses. Thus, the only possibility of an attack would be a man-in-the-middle between the app and spotify, which is unlikely (HTTPS and stuff). However, I'm still not sure why it's in the code base. I can't think of any reason right now TBH,was there since the first commits 😅

Will test it without the setting and if tests succeed, I will remove it in an upcoming release!