-
Notifications
You must be signed in to change notification settings - Fork 4.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add System.Type converter for JsonSerializer #34249
Conversation
What's the point of writing |
IMHO, we should throw exception for both serialization and deserialization. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think we can say A workaround is to use a custom converter and leave it at that. What is the implementation of this theoretical custom converter?
If we believe there's a secure way to implement this, the exception text should point to documentation which shows clearly how to do this safely.
...raries/System.Text.Json/src/System/Text/Json/Serialization/Converters/Value/TypeConverter.cs
Outdated
Show resolved
Hide resolved
Makes sense to throw since we won't round-trip otherwise. |
I've removed the note about using a custom converter - users already know they can write one. Not sure of a way to implement this safely for arbitrary user input. There doesn't seem to be much appetite to (de)serialize |
It's not safe for arbitrary input, but it can be made safe for known-good inputs. For example, maybe your custom converter maintains a static It really depends on the application's specific scenario. |
Test failure unrelated - #28553. |
Fixes #31567. Per the conversation in this issue & following triage, this PR adds a new converter for
System.Type
with the following behavior:serialization: writes the
AssemblyQualifiedName
of theType
instance. This is compatible with Newtonsoft.Json.deserialization: throws
NotSupportedException
, as deserializingType
instances from arbitrary user input is a security vulnerability. Relevant path and reader position information is added to the exception message, as applicable.The behavior before this PR was a
JsonException
(max depth exceeded) on serialization, andJsonException
on deserialization (most commonly due to the current token beingJsonTokenType.String
rather thanJsonTokenType.StartObject
as the serializer expects when parsing object types).EDIT: the converter will throw a
NotSupportedException
for both serialization and deserialization.