Why does System.Formats.Nrbf.ArrayRecord.GetArray require the type of the object in the array?

[qsc-jhndnn]

I'm using the prerelease Nrbf library from Nuget. It's not clear to me why I need to pass in the type into ArrayRecord.GetArray given that all I get from that call is an array of ClassRecords. In my use case I would like to load data that was serialized using the BinaryFormatter in an application that doesn't have any reference to the classes used during serialization. In moving to a new serializer we want to rearchitect the model so keeping the old models around isn't ideal. I've also determined that it's really just checking the type name - I was able to create an empty shell of the class with the same name/namespace without any members at all and was able to deserialize without any issues.

Here's a simple example.

using System.Runtime.Serialization.Formatters.Binary;
using System.Formats.Nrbf;

namespace SerializerTest
{
  [Serializable]
  public class Bar
  {
    public string Name { get; set; }
  }

  [Serializable]
  public class Foo
  {
    public string Name { get; set; }
    Bar[] Bars { get; set; }

  public static void Test()
    {
      Foo foo = new Foo
      {
        Name = "John",
        Bars = new [] 
        {
          new Bar { Name = "Bar1" },
          new Bar { Name = "Bar2" },
          new Bar { Name = "Bar3" },
        }
      };

#pragma warning disable SYSLIB0011 // Type or member is obsolete
      var bf = new BinaryFormatter();
#pragma warning restore SYSLIB0011 // Type or member is obsolete
      var ms = new MemoryStream();
      bf.Serialize(ms, foo);
      ms.Position = 0;

      SerializationRecord headerObject = NrbfDecoder.Decode(ms, null, true);
      var cr = headerObject as ClassRecord;
      Console.WriteLine($"### HEADER");
      Console.WriteLine($"Name: {cr.GetString("<Name>k__BackingField")}");

      var bars = cr.GetArrayRecord("<Bars>k__BackingField");

      // possible to get this without knowing the type?
      var _bars = bars.GetArray(typeof(Bar[]));
      Console.WriteLine($"### BARS");
    }
  }
}

In the case that I was generating the serialization data somewhere else I could just define this

  public class Bar
  {
  }

and would be able to still read the Name member so it's not clear what the type accomplishes.

[huoyaoyuan]

GetArray lets the NRBF library creates the array and objects for you. For security manner, it must not create a type that the caller code is not aware of.

I was able to create an empty shell of the class with the same name/namespace without any members at all and was able to deserialize without any issues.

This is safe because the code of the type has clearly no risk. It also guarantees that the payload doesn't contain other types.

[qsc-jhndnn]

Thank you for the response

GetArray lets the NRBF library creates the array and objects for you. For security manner, it must not create a type that the caller code is not aware of.

In my example, if I have a single Bar as a member I can create a ClassRecord for that using GetRawValue without any class defined. That seems to be functionally equivalent to the array of items I get back from GetArrayRecord. Why is GetRawValue considered safe without a type but GetArrayRecord isn't?

[huoyaoyuan]

Inspecting the implementation and documentation, GetRawValue is only allowed to return primitive types, or a SerializationRecord that you need to inspect yourself. The possible return types are a closed set.

[qsc-jhndnn]

I feel like I'm missing something here since I'm still confused...

For fields

1. Call GetRawValue on ClassRecord which returns a SerializationRecord
2. The returned value can be cast to a ClassRecord
3. Call GetString on returned ClassRecord to get a field from class

Compared to arrays

1. Call GetArrayRecord on ClassRecord which returns an ArrayRecord
2. Call GetArray on ArrayRecord which returns an array of SerivceRecords? Documentation is a little unclear since it says "serialized records themselves"
3. Cast each item in array to ClassRecord
4. Call GetString on returned ClassRecord to get a field from class

So in both cases I end up with a ClassRecord that I inspect via GetString. There doesn't seem to be a difference between the 2 approaches other than GetArray requiring a type.

[huoyaoyuan]

@adamsitnik can you answer this?