Breaking Change BC4915
Visible to All Users

.NET Desktop controls now automatically detect potentially unsafe data types and block their deserialization

To enhance security, we now use a safety mechanism for all deserialization-related operations. An exception is thrown if a DevExpress control attempts to load an unsafe type.

Deserialize trusted types

Carefully review all unsafe type exceptions. If you trust a given type, use the following code to enable deserialization.

C#
DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(typeof(CustomClass));
Visual Basic
DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(GetType(CustomClass))

Call the following method to trust all types from a specific assembly:

C#
DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly("CustomAssembly, Version=x.x.x.x, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxxx"); DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly(typeof(CustomClass).Assembly);
Visual Basic
DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly("CustomAssembly, Version=x.x.x.x, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxxx") DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly(GetType(CustomClass).Assembly)

Trust relevant portions of your code

If you trust the data source that raised a security exception, you can disable safe deserialization for relevant portions of your code:

C#
DevExpress.Utils.DeserializationSettings.InvokeTrusted(()=>{ // Trusted deserialization. // gridView1.RestoreLayoutFromXml(fileName); });
Visual Basic
DevExpress.Utils.DeserializationSettings.InvokeTrusted( Sub() ' Trusted deserialization. ' GridView1.RestoreLayoutFromXml(fileName) End Sub )

See also:

Visual Controls now (de)serialize their Tag property only if this property contains data of a primitive type, string, decimal, DateTime, TimeSpan or Guid
The sort, group and MRU filter configuration is now (de)serialized in text format. The MRU filter history, if saved in previous versions, cannot be deserialized.

Disclaimer: The information provided on DevExpress.com and affiliated web properties (including the DevExpress Support Center) is provided "as is" without warranty of any kind. Developer Express Inc disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.

Confidential Information: Developer Express Inc does not wish to receive, will not act to procure, nor will it solicit, confidential or proprietary materials and information from you through the DevExpress Support Center or its web properties. Any and all materials or information divulged during chats, email communications, online discussions, Support Center tickets, or made available to Developer Express Inc in any manner will be deemed NOT to be confidential by Developer Express Inc. Please refer to the DevExpress.com Website Terms of Use for more information in this regard.