Use XmlSerializer instead of insecure BinaryFormatter in TransferDataSource

Directory.Build.props

@@ -6,7 +6,7 @@
     <InMonoDevelopTree Condition="Exists('$(MSBuildThisFileDirectory)..\..\msbuild\MonoDevelop.AfterCommon.props')">True</InMonoDevelopTree>
     <Net6 Condition="Exists('$(MSBuildThisFileDirectory)..\..\msbuild\Net6.props')">True</Net6>
 
-    <DotNetFrameworkTarget>net461</DotNetFrameworkTarget>
+    <DotNetFrameworkTarget>net472</DotNetFrameworkTarget>
     <DotNetCoreTarget>netstandard2.0</DotNetCoreTarget>
 
     <MacTargetFramework Condition="!$(Net6)">$(DotNetFrameworkTarget)</MacTargetFramework>

Xwt.Gtk/Xwt.GtkBackend/Util.cs

@@ -79,7 +79,7 @@ public static void SetSelectionData (Gtk.SelectionData data, string atomType, ob
 				data.SetUris(new string[] { ((Uri)val).AbsolutePath });
 			else {
 				var at = Gdk.Atom.Intern (atomType, false);
-				data.Set (at, 0, TransferDataSource.SerializeValue (val));
+				data.Set (at, 0, TransferDataSource.SerializeValue (val, val.GetType()));
 			}
 		}
 

Xwt.WPF/Xwt.WPFBackend/DataConverter.cs

@@ -373,7 +373,7 @@ public static DataObject ToDataObject (this TransferDataSource data)
 					uris.Add (((Uri)value).LocalPath);
 					retval.SetFileDropList (uris);
 				} else
-					retval.SetData (type.Id, TransferDataSource.SerializeValue (value));
+					retval.SetData (type.Id, TransferDataSource.SerializeValue (value, value.GetType()));
 			}
 
 			return retval;

Xwt.XamMac/Xwt.Mac/MacClipboardBackend.cs

@@ -80,7 +80,7 @@ public override object GetData (TransferDataType type)
 				var bytes = new byte [data.Length];
 				using (var stream = new UnmanagedMemoryStream ((byte*)data.Bytes, bytes.Length))
 					stream.Read (bytes, 0, bytes.Length);
-				return TransferDataSource.DeserializeValue (bytes);
+				return TransferDataSource.DeserializeValue (bytes, Type.GetType (type.Id));
 			}
 		}
 
@@ -121,7 +121,7 @@ public void ProvideData (NSPasteboard pboard, NSString type)
 			else if (obj is string)
 				data = NSData.FromString ((string)obj);
 			else
-				data = NSData.FromArray (TransferDataSource.SerializeValue (obj));
+				data = NSData.FromArray (TransferDataSource.SerializeValue (obj, obj.GetType()));
 			pboard.SetDataForType (data, type);
 		}
 	}

Xwt.XamMac/Xwt.Mac/ViewBackend.cs

@@ -968,7 +968,7 @@ public void ProvideDataForType (NSPasteboard pasteboard, NSPasteboardItem item,
 					else {
 						// For internal types, provided serialized data
 						object value = dataSource.GetValue(transferDataType);
-						NSData serializedData = NSData.FromArray(TransferDataSource.SerializeValue(value));
+						NSData serializedData = NSData.FromArray(TransferDataSource.SerializeValue(value, value.GetType()));
 						pasteboard.SetDataForType(serializedData, type);
 					}
 				}

Xwt/Xwt.Backends/TransferDataStore.cs

@@ -78,7 +78,7 @@ public void AddValue (TransferDataType type, byte[] value)
 		{
 			Type t = Type.GetType (type.Id);
 			if (t != null)
-				data [type] = TransferDataSource.DeserializeValue (value);
+				data [type] = TransferDataSource.DeserializeValue (value, t);
 			else
 				data [type] = value;
 		}
@@ -119,7 +119,7 @@ T ITransferData.GetValue<T> ()
 			if (ob == null || ob.GetType () == typeof(Type))
 				return (T) ob;
 			if (ob is byte[]) {
-				T val = (T) TransferDataSource.DeserializeValue ((byte[])ob);
+				T val = (T) TransferDataSource.DeserializeValue ((byte[])ob, typeof(T));
 				data[TransferDataType.FromType (typeof(T))] = val;
 				return val;
 			}

Xwt/Xwt.csproj

@@ -1,5 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
+    <TargetFramework>netstandard2.0</TargetFramework>
     <GenerateAssemblyInfo>false</GenerateAssemblyInfo>
     <SignAssembly>true</SignAssembly>
     <AssemblyOriginatorKeyFile>..\xwt.snk</AssemblyOriginatorKeyFile>

Xwt/Xwt/TransferDataSource.cs

@@ -31,7 +31,8 @@
 using System.Runtime.Serialization.Formatters.Binary;
 using Xwt.Drawing;
 using Xwt.Backends;
-
+using System.Xml.Serialization;
+using System.Text;
 
 namespace Xwt
 {
@@ -138,33 +139,59 @@ public object GetValue (TransferDataType type)
 			}
 			return null;
 		}
-		
+
 		/// <summary>
-		/// Serializes a value to a byte array using <see cref="System.Runtime.Serialization.Formatters.Binary.BinaryFormatter"/> .
+		/// Serializes a value to a byte array using <see cref="System.Xml.XmlSerializer"/> .
 		/// </summary>
 		/// <returns>The serialized value.</returns>
 		/// <param name="val">The value to serialize.</param>
-		public static byte[] SerializeValue (object val)
+		public static byte[] SerializeValue (object val, Type type)
 		{
-			using (MemoryStream ms = new MemoryStream ()) {
-				BinaryFormatter bf = new BinaryFormatter ();
-				bf.Serialize (ms, val);
-				return ms.ToArray ();
+			using (var stream = new MemoryStream ()) {
+				using (var writer = new StreamWriter (stream, new UTF8Encoding ())) {
+					var xmlSerializer = new XmlSerializer (type);
+					xmlSerializer.Serialize (writer, val);
+				}
+				return stream.ToArray ();
 			}
 		}
 
 		/// <summary>
 		/// Deserializes a value from a byte array.
 		/// </summary>
 		/// <returns>The deserialized value.</returns>
-		/// <param name="data">The byte array containing the serialized value.</param>
-		public static object DeserializeValue (byte[] data)
+		/// <param name="data">The byte array containing the Utf8 XML serialized value.</param>
+		public static object DeserializeValue (byte[] data, Type type)
 		{
-			using (MemoryStream ms = new MemoryStream (data)) {
-				BinaryFormatter bf = new BinaryFormatter ();
-				return bf.Deserialize (ms);
+			using (var stream = new MemoryStream (data)) {
+				using (var reader = new StreamReader (stream, new UTF8Encoding ())) {
+					var xmlSerializer = new XmlSerializer (type);
+					return xmlSerializer.Deserialize (reader);
+				}
 			}
 		}
+
+		/// <summary>
+		/// Serializes a value to a byte array using <see cref="System.Runtime.Serialization.Formatters.Binary.BinaryFormatter"/> .
+		/// </summary>
+		/// <returns>The serialized value.</returns>
+		/// <param name="val">The value to serialize.</param>
+		[Obsolete("Use SerializeValue (object val, Type type) instead", true)]
+		public static byte[] SerializeValue(object val)
+		{
+			return new byte[0];
+		}
+
+		/// <summary>
+		/// Deserializes a value from a byte array.
+		/// </summary>
+		/// <returns>The deserialized value.</returns>
+		/// <param name="data">The byte array containing the serialized value.</param>
+		[Obsolete("Use DeserializeValue (byte[] data, Type type) instead", true)]
+		public static object DeserializeValue(byte[] data)
+		{
+			return null;
+		}
 	}
 
 	/// <summary>