You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: conceptual/DeploymentConfiguration/Deployment/binary-formatter-security.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,19 +7,19 @@ summary: "The .NET Core 3.1 BinaryFormatter, used for binary serialization, is c
7
7
---
8
8
# BinaryFormatter security
9
9
10
-
In .NET Core 3.1 `T:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter`, which is used for binary serialization of CLR objects, began to be considered insecure and dangerous. In .NET 5.0, `T:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter` started to throw an exception upon its use in ASP.NET Core applications. In .NET 8.0, more serialization-related APIs started to be obsolete and by default, BinaryFormatter is disabled (throwing exceptions) in all .NET 8.0 projects with an exception of WinForms and WPF projects. In .NET 9.0, the implementation of BinaryFormatter class and related types is removed from runtime and all members of these types now have only throwing implementation.
10
+
In .NET Core 3.1 <xref:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter>, which is used for binary serialization of CLR objects, began to be considered insecure and dangerous. In .NET 5.0, <xref:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter> started to throw an exception upon its use in ASP.NET Core applications. In .NET 8.0, more serialization-related APIs started to be obsolete and by default, `BinaryFormatter` is disabled (throwing exceptions) in all .NET 8.0 projects with an exception of WinForms and WPF projects. In .NET 9.0, the implementation of the `BinaryFormatter` class and its related types have been removed, and all members of these types now only have exception-throwing implementation.
11
11
12
12
The attack vector of this vulnerability is deserialization of data that could be manipulated by the attacker, which can result in execution of arbitrary command under credentials of the process that executed the deserialization.
13
13
14
14
## Impact of vulnerability on PostSharp
15
15
16
-
PostSharp allows multiple methods of serializing aspects. The `T:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter`is used if the type has the `[Serializable]` attribute in C#. After PostSharp 4.0, the preferred method of serialization is using `T:PostSharp.Serialization.PSerializableAttribute`, which results in use of `T:PostSharp.Serialization.PortableFormatter`, which is our PostSharp's efficient and portable serialization format for aspect serialization.
16
+
PostSharp allows multiple ways to serialize aspects. The <xref:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter> class is used if the type has the `[Serializable]` attribute in C#. After PostSharp 4.0, the preferred method of serialization became through <xref:PostSharp.Serialization.PSerializableAttribute?text=[PSerializable]>, which results in using <xref:PostSharp.Serialization.PortableFormatter>, our own efficient and portable implementation specialized in serializing aspects.
17
17
18
18
Since PostSharp 2024.0, using `[Serializable]` on aspect classes will result in a build-time error LA0206.
19
19
20
20
In legacy applications that require usage of binary serialization, you can disable this error by setting `PostSharpBinaryFormatterAllowed` MSBuild property to `true`.
21
21
22
-
When building under .NET 9.0+ in Postsharp 2025.0 and later, using this setting will automatically reference `System.Runtime.Serialization.Formattters` package as a build-time dependency. Additional steps have to be taken to enable runtime support for aspect binary deserialization. See more [in Microsoft documentation](https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-migration-guide/compatibility-package). .
22
+
When building under .NET 9.0+ in PostSharp 2025.0 and later, using this setting will automatically reference the `System.Runtime.Serialization.Formattters` package as a build-time dependency. Additional steps must be taken to enable runtime support for aspect binary deserialization. See more in the [.NET documentation](https://learn.microsoft.com/en-us/dotnet/standard/serialization/binaryformatter-migration-guide/compatibility-package).
23
23
24
24
> [!CAUTION]
25
25
> Using `PostSharpBinaryFormatterAllowed` is not recommended and is unsupported.
@@ -29,7 +29,7 @@ When building under .NET 9.0+ in Postsharp 2025.0 and later, using this setting
29
29
30
30
## Recommended actions
31
31
32
-
Since the usage of BinaryFormatter is unsupported by Microsoft and in most projects using it would cause a runtime exception, it is recommended to use PortableFormatter for serializing aspects instead.
32
+
Since the usage of `BinaryFormatter` is unsupported by Microsoft and in most projects using it would cause a runtime exception, it is recommended to use `PortableFormatter` for serializing aspects instead.
33
33
34
34
All aspects and types that are used for aspect serialization should use `[PSerializable]` instead of `[Serializable]`.
Copy file name to clipboardExpand all lines: conceptual/DeploymentConfiguration/Deployment/requirements-20250.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ product: "postsharp"
5
5
categories: "PostSharp;AOP;Metaprogramming"
6
6
summary: "PostSharp 2025.0 supports C# 13.0 or earlier and VB 16.9 or earlier. It requires Microsoft Visual Studio 2022, .NET Framework 4.7.2 or later, and is compatible with various operating systems and .NET SDK versions. It also supports Blazor via .NET Standard."
7
7
---
8
-
# PostSharp 2024.1: Requirements and Compatibility
8
+
# PostSharp 2025.0: Requirements and Compatibility
9
9
10
10
You can use PostSharp to build applications that target a wide range of target devices. This article lists the requirements for development, build and end-user devices.
Copy file name to clipboardExpand all lines: conceptual/Introduction/WhatsNew/breaking-changes-20250.md
+6-3Lines changed: 6 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,8 +11,8 @@ PostSharp 2025.0 contains a small number of breaking changes mainly related to p
11
11
12
12
## PostSharp
13
13
* To build .NET Standard, .NET Core and .NET projects, .NET 8.0 SDK is required. Older SDKs are no longer supported.
14
-
* PostSharp aspects required to use `[PSerializable]` instead of `[Serializable]` for aspects serialization.
15
-
Projects that still require using `[Serializable]` for aspects should explicitly set the `PostSharpBinaryFormatterAllowed` MSBuild property to `True`, but use of this option is unsupported.
14
+
* PostSharp aspects must now use `[PSerializable]` instead of `[Serializable]` for aspects serialization.
15
+
Projects that still require using `[Serializable]` for aspects should explicitly set the `PostSharpBinaryFormatterAllowed` MSBuild property to `True`, but the use of this option is unsupported, which means it is not guaranteed to work.
16
16
* PostSharp Compiler internal dependencies have been upgraded. Consequently, downloading NuGet packages will be necessary during the initial build, potentially requiring manual action for users.
17
17
18
18
## PostSharp.Patterns.Common
@@ -31,4 +31,7 @@ PostSharp 2025.0 contains a small number of breaking changes mainly related to p
31
31
* The package has a new direct dependency on `System.Text.Encodings.Web` 4.7.2.
Copy file name to clipboardExpand all lines: conceptual/Introduction/WhatsNew/whats-new-20250.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -24,4 +24,5 @@ PostSharp 2025.0 introduces support for .NET 9.0 along with some platform update
24
24
25
25
## PostSharp Pattern Libraries
26
26
27
-
* Dependencies of pattern libraries were upgraded to versions without known security vulnerabilities.
27
+
* Dependencies of pattern libraries were upgraded to versions without known security vulnerabilities.
28
+
* Weak event primitive used in `[NotifyPropertyChanged]` and `[WeakEvent]` was significantly optimized to improve performance in edge cases. The amortized complexity profile now matches that of a manually written event-field.
0 commit comments