To enhance security, we now use a safety mechanism for all deserialization-related operations. An exception is thrown if a DevExpress control attempts to load an unsafe type.
Deserialize trusted types
Carefully review all unsafe type exceptions. If you trust a given type, use the following code to enable deserialization.
C#DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(typeof(CustomClass));
Visual BasicDevExpress.Utils.DeserializationSettings.RegisterTrustedClass(GetType(CustomClass))
Call the following method to trust all types from a specific assembly:
C#DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly("CustomAssembly, Version=x.x.x.x, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxxx");
DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly(typeof(CustomClass).Assembly);
Visual BasicDevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly("CustomAssembly, Version=x.x.x.x, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxxx")
DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly(GetType(CustomClass).Assembly)
Trust relevant portions of your code
If you trust the data source that raised a security exception, you can disable safe deserialization for relevant portions of your code:
C#DevExpress.Utils.DeserializationSettings.InvokeTrusted(()=>{
// Trusted deserialization.
// gridView1.RestoreLayoutFromXml(fileName);
});
Visual BasicDevExpress.Utils.DeserializationSettings.InvokeTrusted(
Sub()
' Trusted deserialization.
' GridView1.RestoreLayoutFromXml(fileName)
End Sub
)
See also:
Visual Controls now (de)serialize their Tag property only if this property contains data of a primitive type, string, decimal, DateTime, TimeSpan or Guid
The sort, group and MRU filter configuration is now (de)serialized in text format. The MRU filter history, if saved in previous versions, cannot be deserialized.