AnyObjectSerializerWrapper Class
This type cannot be used anymore to make any type serializable by BinaryFormatter due to security reasons. Use BinarySerializationFormatter instead, whose entire deserialization can work in safe mode if needed.
Provides a wrapper class for serializing any kind of object, including the ones
that are not marked by the
SerializableAttribute, or which are not supported by
BinaryFormatter.
Can be useful when a
BinarySerializationFormatter payload cannot be used, so a
BinaryFormatter-compatible stream must be produced.
When this object is deserialized, the clone of the wrapped original object is returned.
Namespace: KGySoft.Serialization.BinaryAssembly: KGySoft.CoreLibraries (in KGySoft.CoreLibraries.dll) Version: 10.0.0
[SerializableAttribute]
[ObsoleteAttribute("This type cannot be used anymore to make any type serializable by BinaryFormatter due to security reasons. Use BinarySerializationFormatter instead, whose entire deserialization can work in safe mode if needed.")]
public sealed class AnyObjectSerializerWrapper : ISerializable,
IObjectReference
<SerializableAttribute>
<ObsoleteAttribute("This type cannot be used anymore to make any type serializable by BinaryFormatter due to security reasons. Use BinarySerializationFormatter instead, whose entire deserialization can work in safe mode if needed.")>
Public NotInheritable Class AnyObjectSerializerWrapper
Implements ISerializable, IObjectReference
[SerializableAttribute]
[ObsoleteAttribute(L"This type cannot be used anymore to make any type serializable by BinaryFormatter due to security reasons. Use BinarySerializationFormatter instead, whose entire deserialization can work in safe mode if needed.")]
public ref class AnyObjectSerializerWrapper sealed : ISerializable,
IObjectReference
[<SealedAttribute>]
[<SerializableAttribute>]
[<ObsoleteAttribute("This type cannot be used anymore to make any type serializable by BinaryFormatter due to security reasons. Use BinarySerializationFormatter instead, whose entire deserialization can work in safe mode if needed.")>]
type AnyObjectSerializerWrapper =
class
interface ISerializable
interface IObjectReference
end
- Inheritance
- Object AnyObjectSerializerWrapper
- Implements
- IObjectReference, ISerializable
This type has been made obsolete because just from the stream to deserialize it cannot be determined whether the consumer formatter
is used in a safe context. Therefore AnyObjectSerializerWrapper deserialization uses safe mode,
which denies deserializing non-serializable types. It renders this type practically useless, but it was
meant for BinaryFormatter anyway, which is also being obsoleted in upcoming .NET versions. To serialize
non-serializable types you still can use BinarySerializationFormatter, which now supports SafeMode,
which should be enabled when deserializing anything from an untrusted source.
When deserializing a stream that has an AnyObjectSerializerWrapper reference, it is ensured that no assemblies
are loaded while unwrapping its content (it may not be true for other entries in the serialization stream, if the formatter is a BinaryFormatter, for example).
Therefore, all the assemblies that are involved by the types wrapped into an AnyObjectSerializerWrapper must be preloaded before deserializing such a stream.
See the security notes at the Remarks section of the BinarySerializationFormatter class for more details.
Since BinarySerializationFormatter supports serialization of
any class, this object is not necessarily needed when BinarySerializationFormatter is used.
In .NET Framework this class supports serialization of remote objects, too.
This class cannot guarantee that an object serialized in one platform can be deserialized in another one.
For such cases some text-based serialization might be better (see also the XmlSerializer).
In .NET Core and above the ISerializable implementation of some types throw a PlatformNotSupportedException.
For such cases setting the forceSerializationByFields in the constructor can be a solution.
For a more flexible customization use the CustomSerializerSurrogateSelector class instead.
