Epic- Update BinaryFormatter usage

[merriemcgaw]

Official BinaryFormatter removal announcement: dotnet/runtime#98245

BinaryFormatter is an inherently unsafe serliazer. WinForms used it quite a bit in early versions and now we should remove as much of this as possible.

This is part of the dotnet/planning/issues/27 theme

• Consider aggressive AppContext switch for enabling safer BinaryFormatedObject usage #8290
• Investigate adding additional TypeConverter metadata to Resx #8297
• Add test coverage for ResX classes #8295
• Clean up usage of BinaryFormatter throughout codebase #1251
• Document how to add a custom TypeConverter for AxHost.State serialization #8296
• Remove BinaryFormatter for property bag serialization #7988
• Remove BinaryFormatter support from Control's ActiveX projection. #7986
• CSV format is put on clipboard as BinaryFormatted string #9059
• Public WinForms / .NET types require the BinaryFormatter when serializing public properties. #9110
• Look at limiting BinaryFormatter usage with CodeDomSerializationStore #9428

Related:

• Epic - Improve Clipboard functionality #6269
• Epic - Make WinForms trim compatible #4649

[weltkante]

whats the replacement for BinaryFormatter in clipboard/drag'n'drop data exchange? anything been announced yet?

[edit] found it myself, #6269, sorry for the noise, will follow that issue as it evolves.

[RussKie]

At this stage we don't have any formed plans or announcements. Binary formatters are used in multiple scenarios - e.g. the clipboard and resources. We are fully aware this deprecation will likely have far reaching impact, and we need to plan accordingly.

[merriemcgaw]

@JeremyKuhne Is there anything you think should be included in this epic that I haven't already added?

[merriemcgaw]

@JeremyKuhne some of these things may go away entirely with your new PRs. I want to capture your work here for Preview 5 and break out a .NET 9 follow up set of items to track separately.

[MagicAndre1981]

why is this only Prio 2 if BinaryFormatter gets removed in .NET9? I think this should be critical issue for .net 9 milestone @merriemcgaw

[merriemcgaw]

@MagicAndre1981 It was pri 2 for the .NET 8 release 😄 , thanks for pointing that out - I'll adjust now!

[kirsan31]

After build our apps with .Net8 we see such warnings for autogenerated typed datasets (actually typed DataTables):

DS.Designer.cs: warning SYSLIB0051: 'DataSet.DataSet(SerializationInfo, StreamingContext, bool)' is obsolete: 'This API supports obsolete formatter-based serialization. It should not be called or extended by application code.' (https://aka.ms/dotnet-warnings/SYSLIB0051)

DS.Designer.cs: warning SYSLIB0051: 'TypedTableBase<DS.SniperRow>.TypedTableBase(SerializationInfo, StreamingContext)' is obsolete: 'This API supports obsolete formatter-based serialization. It should not be called or extended by application code.' (https://aka.ms/dotnet-warnings/SYSLIB0051)

What will happen with all of this in .Net9? We have some of these legacy typed datasets generated by designer 😳 Also time to time we use designer to edit generated datasets.

• What will be with already generated datasets - will them cotinine to work?
• If on first point answer is yes, then will we can to edit them with visual designer (edit existing tables and create new one)?
  

[kirsan31]

/cc @merriemcgaw @JeremyKuhne

[JeremyKuhne]

@KlausLoeffelmann this is something we'll want to investigate.

@kirsan31 at worst, you'll have to reference a new NuGet package to get this to work. We're working on making sure embedded resources just work (as they're considered trusted). I'm not sure what the BinaryFormatter workflow is for data sets, but we'll look to make sure we're fully clear how it might be impacted.

[KlausLoeffelmann]

Yes, this is definitely something we need to test intensively.

[MagicAndre1981]

What is the current state now that BinaryFormatter was removed from runtime and moved to System.Runtime.Serialization.Formatters nuget?

Do you use this nuget now for Winforms if you can't removed BF until deadline for .net9? What impact will this have to WinForm Devs? Do we also need to enable it in the csproj of the winforms project?

<EnableUnsafeBinaryFormatterSerialization>true</EnableUnsafeBinaryFormatterSerialization>

[JeremyKuhne]

Marking as 10 for remaining work.

[MagicAndre1981]

@JeremyKuhne and what happens in .NET9? Will the nuget be referenced automatically when UseWinForms is set in csproj?

[JeremyKuhne]

@MagicAndre1981 the package will not be referenced automatically. Anything that could be moved away from the BinaryFormatter has been. Remaining (.NET 10) work is to improve diagnostics for guidance when you're potentially hitting BinaryFormatter paths and adding of new API to reduce risk when you're using the BinaryFormatter with custom types on the clipboard and with drag/drop.

More detailed guidance documents are being finalized and will be posted soon. @lonitra