What Changed
To enhance overall security, we modified internal logic associated with type name processing (including, but not limited to, our deserialization mechanism).
DefaultDataSerializer will now generate security warnings when processing custom types.
Previous Behavior
Our API did not generate security warnings when processing unsafe types.
Reasons for Change
This change enhances overall application security by detecting code that processes unsafe types.
Impact on Existing Apps
To explicitly trust a custom type for restore operations, call the RegisterTrustedClass
method.
C#static void Main() {
DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(typeof(CustomClass));
// ...
}
We plan to extend the BindToTypePolicy
class in future releases and introduce a robust type policy manager.
Note: If your current deserialization policy trusts a specific custom type, using the "trusted" type within restore operations will not generate security warnings.
If you are unable to resolve issues introduced by this change, contact DevExpress support for assistance.
How to Revert to Previous Behavior
The previous behavior is no longer available.