Move `ResXResourceReader` and `ResXResourceSet` from `System.Windows.Forms` to `System.Runtime`

[AchimStuy]

Hello everybody,

at first I'm neither sure, whether this is the right repository nor whether it is truely an API proposal. If not, please excuse and help me, where to open the issue.

Background and Motivation

In an ASP.NET Core application I have a requirement to change ResX-Files without recompile. I would implement a custom IStringLocalizer, which reads from the ResX-files instead of the compiled resources.

Proposed API

Now there is a ResXResourceReader inside the System.Resources, but it's in System.Windows.Forms.dll. So currently I build a package with the Microsoft.Net.Sdk.WindowsDesktop and add that package to my WebApplication. There are no compile errors, but still this sounds wrong. And I don't want to copy paste the RexXResourceReader-code.

So I propose to move ResXResourceReader and ResXResourceSet to System.Runtime.dll just like the ResourceManager class.

Usage Examples

ResXResourceReader should be usable inside Microsoft.Net.Sdk.Web-Projects.

Alternative Designs

Maybe ResXResourceReader is already usable in Microsoft.Net.Sdk.Web-Projects. Then please tell me, how?

Risks

Stuff compiled against System.Windows.Forms could break. So maybe there would need to be a workaround.

Tagging subscribers to this area: @tarekgh, @buyaa-n, @krwq
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Hello everybody,

at first I'm neither sure, whether this is the right repository nor whether it is truely an API proposal. If not, please excuse and help me, where to open the issue.

Background and Motivation

In an ASP.NET Core application I have a requirement to change ResX-Files without recompile. I would implement a custom IStringLocalizer, which reads from the ResX-files instead of the compiled resources.

Proposed API

Now there is a ResXResourceReader inside the System.Resources, but it's in System.Windows.Forms.dll. So currently I build a package with the Microsoft.Net.Sdk.WindowsDesktop and add that package to my WebApplication. There are no compile errors, but still this sounds wrong. And I don't want to copy paste the RexXResourceReader-code.

So I propose to move ResXResourceReader and ResXResourceSet to System.Runtime.dll just like the ResourceManager class.

Usage Examples

ResXResourceReader should be usable inside Microsoft.Net.Sdk.Web-Projects.

Alternative Designs

Maybe ResXResourceReader is already usable in Microsoft.Net.Sdk.Web-Projects. Then please tell me, how?

Risks

Stuff compiled against System.Windows.Forms could break. So maybe there would need to be a workaround.

Author:	AchimStuy
Assignees:	-
Labels:	api-suggestion, area-System.Resources, untriaged
Milestone:	-

[joperezr]

There are many things that would need to be considered if we in fact decided to move the type down to the framework, so I believe we might need a big case to be made for this, given the fact that you have a workaround for this today which is just to reference it from the WinForms package. @ericstj thoughts about moving these two down? They might not need to go in ResourceManager but we could potentially consider moving them over in Resources.Extensions right next to the BinaryFormatter reader/writers.

[ericstj]

I don’t recommend we move these types down and would recommend that you avoid using them at runtime. ResXReader activates types listed in the ResX which leads to code execution.

Instead just parse the XML. This is what the shipping loc tasks (and MSBuild itself) do #47795.

[koszeggy]

@AchimStuy: The system ResXResourceReader has a sort of security flaws. Even if its UseResXDataNodes property is true, it can load assemblies while parsing a .resx file.

But if you don't mind using a NuGet package in your project you can use an alternative .resx infrastructure, which can be used even in .NET Core and on non-Windows platforms (disclaimer: written by me). It also has a ResXResourceReader class, which is more or less compatible with the system version, and also offers a SafeMode property (false by default).

Additionally, if offers a ResXResourceManager (and some other managers, see the first link), so if you want to use resources in your apps directly from .resx files instead of compiled satellite .dll-s, you can do it without using the low-level ResXResourceReader directly. It also has its own SafeMode property, which you definitely should set to true if the .resx files can be targets of security attacks.