dotnet / dotnet/dotnet-api-docs
Document correct serialization of exceptions in security-transparent assemblies
- Dominant language
- C#
- Stars
- 949
- Forks
- 1.7k
- Avg merge
- 3d 27m
- Merged PRs (30d)
- 49
Description
When implementing exceptions with state, it's necessary to implement serialization in order to allow such exceptions to pass AppDomain boundaries. Up to .NET 4, this was done simply by overriding `GetObjectData` and providing a deserialization constructor.
Starting with .NET 4 and its security model, this is no longer possible with assemblies that have the `AllowPartiallyTrustedCallersAttribute`. As these are loaded to be security-transparent, they cannot override `GetObjectData`. .NET 4 therefore added `Exception.SerializeObjectState` (https://docs.microsoft.com/de-de/dotnet/api/system.exception.serializeobjectstate?view=netframework-4.7.1), thus defining a new pattern for serializable exceptions.
This new pattern is however insufficiently documented. It should be explained in the "Remarks" sections of both the `System.Exception` class (https://docs.microsoft.com/de-de/dotnet/api/system.exception?view=netframework-4.7.1) and the `Exception.GetObjectData` method (https://docs.microsoft.com/de-de/dotnet/api/system.exception.getobjectdata?view=netframework-4.7.1#System_Exception_GetObjectData_System_Runtime_Serialization_SerializationInfo_System_Runtime_Serialization_StreamingContext_).
Contributor guide
Assessment
This issue has not been assessed yet.