Skip to content

Commit 74b5bbc

Browse files
committed
Review changes, weak events note.
1 parent 0c7e7c9 commit 74b5bbc

File tree

4 files changed

+13
-9
lines changed

4 files changed

+13
-9
lines changed

conceptual/DeploymentConfiguration/Deployment/binary-formatter-security.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,19 @@ summary: "The .NET Core 3.1 BinaryFormatter, used for binary serialization, is c
77
---
88
# BinaryFormatter security
99

10-
In .NET Core 3.1 `T:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter`, which is used for binary serialization of CLR objects, began to be considered insecure and dangerous. In .NET 5.0, `T:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter` started to throw an exception upon its use in ASP.NET Core applications. In .NET 8.0, more serialization-related APIs started to be obsolete and by default, BinaryFormatter is disabled (throwing exceptions) in all .NET 8.0 projects with an exception of WinForms and WPF projects. In .NET 9.0, the implementation of BinaryFormatter class and related types is removed from runtime and all members of these types now have only throwing implementation.
10+
In .NET Core 3.1 <xref:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter>, which is used for binary serialization of CLR objects, began to be considered insecure and dangerous. In .NET 5.0, <xref:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter> started to throw an exception upon its use in ASP.NET Core applications. In .NET 8.0, more serialization-related APIs started to be obsolete and by default, `BinaryFormatter` is disabled (throwing exceptions) in all .NET 8.0 projects with an exception of WinForms and WPF projects. In .NET 9.0, the implementation of the `BinaryFormatter` class and its related types have been removed, and all members of these types now only have exception-throwing implementation.
1111

1212
The attack vector of this vulnerability is deserialization of data that could be manipulated by the attacker, which can result in execution of arbitrary command under credentials of the process that executed the deserialization.
1313

1414
## Impact of vulnerability on PostSharp
1515

16-
PostSharp allows multiple methods of serializing aspects. The `T:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter` is used if the type has the `[Serializable]` attribute in C#. After PostSharp 4.0, the preferred method of serialization is using `T:PostSharp.Serialization.PSerializableAttribute`, which results in use of `T:PostSharp.Serialization.PortableFormatter`, which is our PostSharp's efficient and portable serialization format for aspect serialization.
16+
PostSharp allows multiple ways to serialize aspects. The <xref:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter> class is used if the type has the `[Serializable]` attribute in C#. After PostSharp 4.0, the preferred method of serialization became through <xref:PostSharp.Serialization.PSerializableAttribute?text=[PSerializable]>, which results in using <xref:PostSharp.Serialization.PortableFormatter>, our own efficient and portable implementation specialized in serializing aspects.
1717

1818
Since PostSharp 2024.0, using `[Serializable]` on aspect classes will result in a build-time error LA0206.
1919

2020
In legacy applications that require usage of binary serialization, you can disable this error by setting `PostSharpBinaryFormatterAllowed` MSBuild property to `true`.
2121

22-
When building under .NET 9.0+ in Postsharp 2025.0 and later, using this setting will automatically reference `System.Runtime.Serialization.Formattters` package as a build-time dependency. Additional steps have to be taken to enable runtime support for aspect binary deserialization. See more [in Microsoft documentation](https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-migration-guide/compatibility-package). .
22+
When building under .NET 9.0+ in PostSharp 2025.0 and later, using this setting will automatically reference the `System.Runtime.Serialization.Formattters` package as a build-time dependency. Additional steps must be taken to enable runtime support for aspect binary deserialization. See more in the [.NET documentation](https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-migration-guide/compatibility-package).
2323

2424
> [!CAUTION]
2525
> Using `PostSharpBinaryFormatterAllowed` is not recommended and is unsupported.
@@ -29,7 +29,7 @@ When building under .NET 9.0+ in Postsharp 2025.0 and later, using this setting
2929
3030
## Recommended actions
3131

32-
Since the usage of BinaryFormatter is unsupported by Microsoft and in most projects using it would cause a runtime exception, it is recommended to use PortableFormatter for serializing aspects instead.
32+
Since the usage of `BinaryFormatter` is unsupported by Microsoft and in most projects using it would cause a runtime exception, it is recommended to use `PortableFormatter` for serializing aspects instead.
3333

3434
All aspects and types that are used for aspect serialization should use `[PSerializable]` instead of `[Serializable]`.
3535

conceptual/DeploymentConfiguration/Deployment/requirements-20250.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ product: "postsharp"
55
categories: "PostSharp;AOP;Metaprogramming"
66
summary: "PostSharp 2025.0 supports C# 13.0 or earlier and VB 16.9 or earlier. It requires Microsoft Visual Studio 2022, .NET Framework 4.7.2 or later, and is compatible with various operating systems and .NET SDK versions. It also supports Blazor via .NET Standard."
77
---
8-
# PostSharp 2024.1: Requirements and Compatibility
8+
# PostSharp 2025.0: Requirements and Compatibility
99

1010
You can use PostSharp to build applications that target a wide range of target devices. This article lists the requirements for development, build and end-user devices.
1111

conceptual/Introduction/WhatsNew/breaking-changes-20250.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ PostSharp 2025.0 contains a small number of breaking changes mainly related to p
1111

1212
## PostSharp
1313
* To build .NET Standard, .NET Core and .NET projects, .NET 8.0 SDK is required. Older SDKs are no longer supported.
14-
* PostSharp aspects required to use `[PSerializable]` instead of `[Serializable]` for aspects serialization.
15-
Projects that still require using `[Serializable]` for aspects should explicitly set the `PostSharpBinaryFormatterAllowed` MSBuild property to `True`, but use of this option is unsupported.
14+
* PostSharp aspects must now use `[PSerializable]` instead of `[Serializable]` for aspects serialization.
15+
Projects that still require using `[Serializable]` for aspects should explicitly set the `PostSharpBinaryFormatterAllowed` MSBuild property to `True`, but the use of this option is unsupported, which means it is not guaranteed to work.
1616
* PostSharp Compiler internal dependencies have been upgraded. Consequently, downloading NuGet packages will be necessary during the initial build, potentially requiring manual action for users.
1717

1818
## PostSharp.Patterns.Common
@@ -31,4 +31,7 @@ PostSharp 2025.0 contains a small number of breaking changes mainly related to p
3131
* The package has a new direct dependency on `System.Text.Encodings.Web` 4.7.2.
3232

3333
## PostSharp.Patterns.Diagnostics.ApplicationInsights
34-
* The dependency on `Microsoft.ApplicationInsights` has been upgraded to 2.22.0.
34+
* The dependency on `Microsoft.ApplicationInsights` has been upgraded to 2.22.0.
35+
36+
## PostSharp.Patterns.Model
37+
* The package no longer supports targeting `netstandard1.3` target framework.

conceptual/Introduction/WhatsNew/whats-new-20250.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,4 +24,5 @@ PostSharp 2025.0 introduces support for .NET 9.0 along with some platform update
2424

2525
## PostSharp Pattern Libraries
2626

27-
* Dependencies of pattern libraries were upgraded to versions without known security vulnerabilities.
27+
* Dependencies of pattern libraries were upgraded to versions without known security vulnerabilities.
28+
* Weak event primitive used in `[NotifyPropertyChanged]` and `[WeakEvent]` was significantly optimized to improve performance in edge cases. The amortized complexity profile now matches that of a manually written event-field.

0 commit comments

Comments
 (0)