Remove SerializableAttribute from list of safe attributes for deserializing Runtime Types

Author: mythz

src/ServiceStack.Text/Common/JsWriter.cs

@@ -161,16 +161,6 @@ public static void AssertAllowedRuntimeType(Type type)
             if (JsConfig.AllowRuntimeType?.Invoke(type) == true)
                 return;
 
-            var denyTypesInNamespaces = JsConfig.DenyRuntimeTypeInNamespaces;
-            if (denyTypesInNamespaces?.Count > 0)
-            {
-                foreach (var ns in denyTypesInNamespaces)
-                {
-                    if (type.Namespace == ns)
-                        throw new NotSupportedException($"{type.Name} is not an allowed Runtime Type. Denied in JsConfig.DenyRuntimeTypeInNamespaces");
-                }
-            }
-
             var allowAttributesNamed = JsConfig.AllowRuntimeTypeWithAttributesNamed;
             if (allowAttributesNamed?.Count > 0)
             {

src/ServiceStack.Text/JsConfig.cs

@@ -921,8 +921,6 @@ public static string[] IgnoreAttributesNamed
 
         public static HashSet<string> AllowRuntimeTypeWithInterfacesNamed { get; set; }
 
-        public static HashSet<string> DenyRuntimeTypeInNamespaces { get; set; }
-
         public static HashSet<string> AllowRuntimeTypeInTypesWithNamespaces { get; set; }
 
         public static Func<Type, bool> AllowRuntimeType { get; set; }
@@ -986,7 +984,6 @@ public static void Reset()
             {
                 nameof(DataContractAttribute),
                 nameof(RuntimeSerializableAttribute),
-                "SerializableAttribute",
             };
             AllowRuntimeTypeWithInterfacesNamed = new HashSet<string>
             {
@@ -1001,10 +998,6 @@ public static void Reset()
             {
                 "ServiceStack.Messaging",
             };
-            DenyRuntimeTypeInNamespaces = new HashSet<string>
-            {
-                "System.CodeDom.Compiler",
-            };
             PlatformExtensions.ClearRuntimeAttributes();
             ReflectionExtensions.Reset();
             JsState.Reset();

tests/ServiceStack.Text.Tests/RuntimeSerializtionTests.cs

@@ -108,9 +108,6 @@ public void Does_Serialize_Allowed_Types()
                 typeof(UserAuth),
                 typeof(UserAuthDetails),
                 typeof(Message),
-#if NET45
-                typeof(SerialiazableType),
-#endif
             };
 
             foreach (var allowType in allowTypes)
@@ -176,9 +173,6 @@ public void Does_Serialize_Allowed_Types_in_Objects_Array()
                 typeof(UserAuth),
                 typeof(UserAuthDetails),
                 typeof(Message),
-#if NET45
-                typeof(SerialiazableType),
-#endif
             };
 
             foreach (var allowType in allowTypes)
@@ -205,32 +199,5 @@ public void Does_allow_Unknown_Type_in_MQ_Messages()
             var fromJson = json.FromJson<Message>();
             Assert.That(fromJson.Body.GetType(), Is.EqualTo(typeof(AType)));
         }
-
-        [Test]
-        public void Does_not_allow_Types_in_DenyRuntimeTypeInTypesWithNamespaces()
-        {
-            //Uses JsConfig.DenyRuntimeTypeInNamespaces
-
-            var types = new Type[]
-            {
-#if NET45
-                typeof(System.CodeDom.Compiler.TempFileCollection)
-#endif
-            };
-
-            foreach (var type in types)
-            {
-                var json = CreateJson(type);
-                try
-                {
-                    var instance = json.FromJson<RuntimeObject>();
-                    Assert.Fail("Should throw " + type.Name);
-                }
-                catch (NotSupportedException ex)
-                {
-                    ex.Message.Print();
-                }
-            }
-        }
     }
 }