Microsoft.XmlSerializer.Generator use of Assembly.LoadFile

[filipnavara]

The XML serializer generator uses Assembly.LoadFile to examine the original assembly for serializable types:

https://github.com/dotnet/runtime/blob/main/src/libraries/Microsoft.XmlSerializer.Generator/src/Sgen.cs#L480C24-L480C41

Can it result in unintended code execution (eg. module initilizers)? Wouldn't it be more appropriate to use Assembly.ReflectionOnlyLoad?

[filipnavara]

As @MichalPetryka pointed out to me, .NET [Core] doesn't support Assembly.ReflectionOnlyLoad[From] which makes this significantly more complicated to fix. Ideally I would like the code to use MetadataLoadContext but the XmlReflectionImporter class used under the covers heavily depends on the types existing in the same context which makes such fix non-trivial.