Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

System.Text.Json doesn't deserialize IDictionary with TKey types other than string #44726

Closed
ekvalizer opened this issue Nov 16, 2020 · 4 comments

Comments

@ekvalizer
Copy link

ekvalizer commented Nov 16, 2020

Description

System.Text.Json.Deserialize() cannot deserialize to IDictionary where TKey has type other than string.
I have following example:

       [Test]
        public void DictionaryTest()
        {
            var dic = new Dictionary<int, string>
            {
                {33, "190"},
                {55, "88"}
            };

            var json = JsonSerializer.Serialize(dic);

            var deserialized = JsonSerializer.Deserialize<IDictionary<int, string>>(json);
            Assert.IsNotNull(deserialized);
        }

This code above would throw exception System.InvalidCastException : Unable to cast object of type 'System.Collections.Generic.Dictionary2[System.String,System.String]' to type 'System.Collections.Generic.IDictionary2[System.Int32,System.String]'.

However if i only change IDictinary type to Dictionary it will work. It seems strange for me because similar example for ICollection<int> would work and i'll get List object.

Configuration

.net 5.0.100
Windows 10 18363.1198 (x64)

@Dotnet-GitSync-Bot Dotnet-GitSync-Bot added area-System.Text.Json untriaged New issue has not been triaged by the area owner labels Nov 16, 2020
@GrabYourPitchforks
Copy link
Member

FYI to JSON team: deserializing to a Dictionary<TKey, TValue> where TKey is typed as anything other than string could introduce a security vulnerability in the consuming application. This isn't a reason to avoid introducing this feature, but if we do introduce it we absolutely need to document its impact.

@ekvalizer ekvalizer changed the title System.Text.Json doesn't deserialize IDictionary with types other than string System.Text.Json doesn't deserialize IDictionary with TKey types other than string Nov 17, 2020
@layomia
Copy link
Contributor

layomia commented Nov 25, 2020

This was fixed for 6.0 in #42835. See that PR for more info. The workaround for 5.0 is to use another dictionary type such as Dictionary<,> as you noted.


@GrabYourPitchforks support for non-string dictionary keys was added in 5.0 (PR, design doc). This support is scoped to primitives such as DateTime, int etc. Unfortunately we have a bug in the feature that this issue calls out.

I've created a doc issue to provide security guidance about this feature: dotnet/docs#21724.

@layomia layomia closed this as completed Nov 25, 2020
@layomia layomia removed the untriaged New issue has not been triaged by the area owner label Nov 25, 2020
@layomia
Copy link
Contributor

layomia commented Dec 2, 2020

Reopening for servicing consideration in 5.0.

@layomia
Copy link
Contributor

layomia commented Dec 14, 2020

Fixed for 5.0.2 in #45449.

@layomia layomia closed this as completed Dec 14, 2020
@ghost ghost locked as resolved and limited conversation to collaborators Jan 13, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

4 participants