Skip to content

Warn when using BinaryFormatter resources while targeting .NET 8+ #8453

@rainersigwald

Description

@rainersigwald

.NET 8 will make BinaryFormatter functionality opt-in, and there's cross-team work to ensure that users have good alternatives and are guided to use them.

GenerateResource can pass BinaryFormatter-serialized resource objects from a source .resx file to .resources files embedded by the compiler:

case BinSerializedObjectMimeType:
case Beta2CompatSerializedObjectMimeType:
case CompatBinSerializedObjectMimeType:
// BinaryFormatter from byte array
byte[] binaryFormatterBytes = Convert.FromBase64String(value);
resources.Add(new BinaryFormatterByteArrayResource(name, binaryFormatterBytes, resxFilename));

We should add a warning when we hit that case, so users are aware that they have BinaryFormatter exposure.

By default the warning should fire only when the user targets .NET 8+. The easiest way to implement this is probably to add a new argument to GenerateResource along the lines of WarnOnBinaryFormatterResources, pass it in as a property in common.targets, and then set a default value for it in the .NET SDK.

The warning must be overridable, because even in the long term (after .NET 9's removal of BinaryFormatter from the BCL) we expect it to be possible for applications to explicitly opt into BinaryFormatter support, and resources are likely to be a particularly long-lived use case.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions