Why is the shape for System.Exception empty?

[AArnott]

The entire shape for System.Exception is:

private global::PolyType.ITypeShape<global::System.Exception> __Create_Exception()
{
    return new global::PolyType.SourceGenModel.SourceGenObjectTypeShape<global::System.Exception>
    {
        IsRecordType = false,
        IsTupleType = false,
        Provider = this,
    };
}

No properties. No constructors.

Why? There are public properties and constructors on this type.

[eiriktsarpalis]

It's currently in the deny list of types for which no shape metadata is being generated, similar to MemberInfo or Task.

[eiriktsarpalis]

Assuming we wanted this, it begs the question of whether PolyType should be touching any of the obsoleted SerializationInfo APIs. They are essential assuming you want to achieve things like marshalling the stacktrace, but at the same time we (the libraries team) have avoided implementing SerializationInfo APIs in new exception types. There are ways we could make this approach safer by wrapping SerializationInfo in a sanitization layer as shown here for example.

A more modest option would involve treating exceptions as regular objects while explicitly ignoring constructors accepting SerializationInfo. A serializer could then set the stacktrace via approved means (ExceptionDispatchInfo.SetRemoteStackTrace available since .NET 6) or by private field manipulation if running on older runtimes. I doubt this would be a perfect solution either since most serializable exception types are built on SerializationInfo and don't assume all properties need a setter or require parity with a constructor parameter.

[AArnott]

I've already implemented an Exception serializer in StreamJsonRpc. It uses the ISerializable interface and SerializationInfo constructors, without using BinaryFormatter so I argue it's "safe" barring an exception constructor 'hiding' binary information in a base64 string in the Data dictionary or doing other similarly stupid stuff.

But given the .NET team is against even that, I wanted to explore a 'safer' serialization of the Exception type using PolyType, based on properties and the non-SerializationInfo constructor.