[Question]：Security Risk in TypeNameHandling.All in JsonSerializerSettings

[contione]

Issue Description:

I have identified a potential security vulnerability in the code where external data sources are being deserialized using Newtonsoft.Json with TypeNameHandling.All enabled. This setting allows the deserialization of types based on the type information present in the JSON payload. While convenient for polymorphic deserialization, it can also pose a security risk if the JSON data comes from untrusted sources. This setting could potentially be exploited for remote code execution (RCE) attacks if not handled carefully.

Code Reference:

workflow-core/src/providers/WorkflowCore.Providers.Azure/Models/PersistedWorkflow.cs

Line 31 in a761d78

private static JsonSerializerSettings SerializerSettings = new JsonSerializerSettings { TypeNameHandling = TypeNameHandling.All };