-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Description
.NET 8 will make BinaryFormatter functionality opt-in, and there's cross-team work to ensure that users have good alternatives and are guided to use them.
GenerateResource can pass BinaryFormatter-serialized resource objects from a source .resx file to .resources files embedded by the compiler:
msbuild/src/Tasks/ResourceHandling/MSBuildResXReader.cs
Lines 186 to 192 in 03de075
| case BinSerializedObjectMimeType: | |
| case Beta2CompatSerializedObjectMimeType: | |
| case CompatBinSerializedObjectMimeType: | |
| // BinaryFormatter from byte array | |
| byte[] binaryFormatterBytes = Convert.FromBase64String(value); | |
| resources.Add(new BinaryFormatterByteArrayResource(name, binaryFormatterBytes, resxFilename)); |
We should add a warning when we hit that case, so users are aware that they have BinaryFormatter exposure.
By default the warning should fire only when the user targets .NET 8+. The easiest way to implement this is probably to add a new argument to GenerateResource along the lines of WarnOnBinaryFormatterResources, pass it in as a property in common.targets, and then set a default value for it in the .NET SDK.
The warning must be overridable, because even in the long term (after .NET 9's removal of BinaryFormatter from the BCL) we expect it to be possible for applications to explicitly opt into BinaryFormatter support, and resources are likely to be a particularly long-lived use case.