CS.UNCHECKED.CAST

This warning is reported in situations when one object, with type Object, is cast to another object with the possibility of lost data or even program failure.

Vulnerability and risk

Either data may be lost, or the program may fail.

Example 1

1
2
3
4
5
6
7
8
9
10
11
                  using System;
                  public class A {
                     public int a;
                  }
                  public class ClassCastTests {
                      public void foo() {
                          A a;
                          Object o = new object();
                          a = (A)o;
                     }
                 }

Object o of class Object and object a of class A are declared on lines 7-8. Then, on line 9, Object is cast to A, which is invalid.

External guidance

• CWE-704: Incorrect Type Conversion or Cast

Security training

Application security training materials provided by Secure Code Warrior.

• Type Confusion Training Video - Test your skills with a training example