{"record":{"id":"da4d815a478d559c","repo":"JamesNK/Newtonsoft.Json","slug":"insufficient-permissions-creating-an-uninitialize","errorCode":null,"errorMessage":"Insufficient permissions. Creating an uninitialized '{0}' type requires full trust.","messagePattern":"Insufficient permissions\\. Creating an uninitialized '(.+?)' type requires full trust\\.","errorType":"exception","errorClass":"JsonException","httpStatus":null,"severity":"critical","filePath":"Src/Newtonsoft.Json/Serialization/JsonObjectContract.cs","lineNumber":196,"sourceCode":"        public JsonObjectContract(Type underlyingType)\n            : base(underlyingType)\n        {\n            ContractType = JsonContractType.Object;\n\n            Properties = new JsonPropertyCollection(UnderlyingType);\n        }\n\n#if HAVE_BINARY_FORMATTER\n#if HAVE_SECURITY_SAFE_CRITICAL_ATTRIBUTE\n        [SecuritySafeCritical]\n#endif\n        internal object GetUninitializedObject()\n        {\n#pragma warning disable SYSLIB0050\n            // we should never get here if the environment is not fully trusted, check just in case\n            if (!JsonTypeReflector.FullyTrusted)\n            {\n                throw new JsonException(\"Insufficient permissions. Creating an uninitialized '{0}' type requires full trust.\".FormatWith(CultureInfo.InvariantCulture, NonNullableUnderlyingType));\n            }\n\n            return FormatterServices.GetUninitializedObject(NonNullableUnderlyingType);\n#pragma warning restore SYSLIB0050\n        }\n#endif\n    }\n}","sourceCodeStart":178,"sourceCodeEnd":204,"githubUrl":"https://github.com/JamesNK/Newtonsoft.Json/blob/4f73e74372445108d2c1bda37b36e6f5e43402e0/Src/Newtonsoft.Json/Serialization/JsonObjectContract.cs#L178-L204","documentation":"Thrown by JsonObjectContract.GetUninitializedObject when JsonTypeReflector.FullyTrusted returns false but the serializer needs to allocate an ISerializable type without invoking its constructor (FormatterServices.GetUninitializedObject). The '{0}' is the non-nullable underlying type. This path is gated by the HAVE_BINARY_FORMATTER compile switch and the runtime trust level.","triggerScenarios":"Deserializing an ISerializable type in a partial-trust or sandboxed AppDomain where FormatterServices.GetUninitializedObject requires full trust. Triggered by the ISerializable deserialization pipeline when it must pre-allocate the object bypassing the constructor.","commonSituations":"Running Json.NET in a medium-trust hosting environment (legacy ASP.NET medium trust, sandboxed AppDomain, partial-trust Azure web/worker roles), or on a target framework where HAVE_BINARY_FORMATTER is defined but the AppDomain is not fully trusted.","solutions":["Run the application in a fully-trusted AppDomain (most modern .NET Core/.NET 5+ hosting is fully trusted by default).","Avoid ISerializable on types you serialize to JSON; use plain POCOs instead so the uninitialized-allocation path is never taken.","If you control the host, raise the trust level (legacy ASP.NET: <trust level=\"Full\"/>).","Migrate to a target where HAVE_BINARY_FORMATTER is undefined (the GetUninitializedObject path is compiled out)."],"exampleFix":"// before\n[Serializable]\npublic class Settings : ISerializable { ... }\nJsonConvert.Deserialize<Settings>(json); // partial trust throws\n// after\npublic class Settings { public Settings() {} public string Key { get; set; } }","handlingStrategy":"validation","validationCode":"if (!AppDomain.CurrentDomain.IsFullyTrusted) throw new InvalidOperationException(\"requires full trust\");","typeGuard":null,"tryCatchPattern":"try { JsonConvert.DeserializeObject<ISerializableType>(json); }\ncatch (JsonException ex) when (ex.Message.Contains(\"Insufficient permissions\")) {\n    logger.Error(ex, \"ISerializable deser requires full trust; raise trust level or use a POCO.\"); throw;\n}","preventionTips":["Prefer plain POCOs over ISerializable for JSON serialization.","Run hosts fully trusted (default on modern .NET).","On legacy ASP.NET set <trust level=\"Full\"/> if ISerializable is mandatory.","Avoid FormatterServices.GetUninitializedObject-dependent flows in sandboxed hosts."],"tags":["serialization","iserializable","security","trust","appdomain"],"analyzedSha":"4f73e74372445108d2c1bda37b36e6f5e43402e0","analyzedAt":"2026-08-07T06:10:08.596Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}