-
Notifications
You must be signed in to change notification settings - Fork 5.3k
Add System.Type converter for JsonSerializer #34249
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
What's the point of writing |
|
IMHO, we should throw exception for both serialization and deserialization. |
GrabYourPitchforks
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think we can say A workaround is to use a custom converter and leave it at that. What is the implementation of this theoretical custom converter?
If we believe there's a secure way to implement this, the exception text should point to documentation which shows clearly how to do this safely.
...raries/System.Text.Json/src/System/Text/Json/Serialization/Converters/Value/TypeConverter.cs
Outdated
Show resolved
Hide resolved
Makes sense to throw since we won't round-trip otherwise. |
I've removed the note about using a custom converter - users already know they can write one. Not sure of a way to implement this safely for arbitrary user input. There doesn't seem to be much appetite to (de)serialize |
It's not safe for arbitrary input, but it can be made safe for known-good inputs. For example, maybe your custom converter maintains a static It really depends on the application's specific scenario. |
|
Test failure unrelated - #28553. |
Fixes #31567. Per the conversation in this issue & following triage, this PR adds a new converter for
System.Typewith the following behavior:serialization: writes the
AssemblyQualifiedNameof theTypeinstance. This is compatible with Newtonsoft.Json.deserialization: throws
NotSupportedException, as deserializingTypeinstances from arbitrary user input is a security vulnerability. Relevant path and reader position information is added to the exception message, as applicable.The behavior before this PR was a
JsonException(max depth exceeded) on serialization, andJsonExceptionon deserialization (most commonly due to the current token beingJsonTokenType.Stringrather thanJsonTokenType.StartObjectas the serializer expects when parsing object types).EDIT: the converter will throw a
NotSupportedExceptionfor both serialization and deserialization.