Breaking Change T1130869
Visible to All Users

DefaultDataSerializer: Enhanced type deserialization

What Changed

To enhance overall security, we modified internal logic associated with type name processing (including, but not limited to, our deserialization mechanism).
DefaultDataSerializer will now generate security warnings when processing custom types.

Previous Behavior

Our API did not generate security warnings when processing unsafe types.

Reasons for Change

This change enhances overall application security by detecting code that processes unsafe types.

Impact on Existing Apps

To explicitly trust a custom type for restore operations, call the RegisterTrustedClass method.

C#
static void Main() { DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(typeof(CustomClass)); // ... }

We plan to extend the BindToTypePolicy class in future releases and introduce a robust type policy manager.
Note: If your current deserialization policy trusts a specific custom type, using the "trusted" type within restore operations will not generate security warnings.
If you are unable to resolve issues introduced by this change, contact DevExpress support for assistance.

How to Revert to Previous Behavior

The previous behavior is no longer available.

Disclaimer: The information provided on DevExpress.com and affiliated web properties (including the DevExpress Support Center) is provided "as is" without warranty of any kind. Developer Express Inc disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.

Confidential Information: Developer Express Inc does not wish to receive, will not act to procure, nor will it solicit, confidential or proprietary materials and information from you through the DevExpress Support Center or its web properties. Any and all materials or information divulged during chats, email communications, online discussions, Support Center tickets, or made available to Developer Express Inc in any manner will be deemed NOT to be confidential by Developer Express Inc. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.