static void CheckTypeForwardedTo(Assembly sourceAssembly, Assembly destinationAssembly, Type resolvedType)
{
if (sourceAssembly != destinationAssembly && !NetDataContractSerializer.UnsafeTypeForwardingEnabled && !sourceAssembly.IsFullyTrusted)
{
// We have a TypeForwardedTo attribute
if (!destinationAssembly.PermissionSet.IsSubsetOf(sourceAssembly.PermissionSet))
{
// We look for a matching TypeForwardedFrom attribute
TypeInformation typeInfo = NetDataContractSerializer.GetTypeInformation(resolvedType);
if (typeInfo.HasTypeForwardedFrom)
{
Assembly typeForwardedFromAssembly = null;
try
{
// if this Assembly.Load fails, we still want to throw security exception
typeForwardedFromAssembly = Assembly.Load(typeInfo.AssemblyString);
}
catch { }
if (typeForwardedFromAssembly == sourceAssembly)
{
return;
}
}
throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(XmlObjectSerializer.CreateSerializationException(SR.GetString(SR.CannotDeserializeForwardedType, DataContract.GetClrTypeFullName(resolvedType))));
}
}
}
// Update the overloads whenever you are changing this method
internal static void WriteClrTypeInfo(XmlWriterDelegator writer, Type dataContractType, SerializationBinder binder, SerializationInfo serInfo)
{
TypeInformation typeInformation = null;
string clrTypeName = null;
string clrAssemblyName = null;
if (binder != null)
{
binder.BindToName(dataContractType, out clrAssemblyName, out clrTypeName);
}
if (clrTypeName == null)
{
if (serInfo.IsFullTypeNameSetExplicit)
{
clrTypeName = serInfo.FullTypeName;
}
else
{
typeInformation = NetDataContractSerializer.GetTypeInformation(serInfo.ObjectType);
clrTypeName = typeInformation.FullTypeName;
}
}
if (clrAssemblyName == null)
{
if (serInfo.IsAssemblyNameSetExplicit)
{
clrAssemblyName = serInfo.AssemblyName;
}
else
{
clrAssemblyName = (typeInformation == null) ?
NetDataContractSerializer.GetTypeInformation(serInfo.ObjectType).AssemblyString :
typeInformation.AssemblyString;
}
}
WriteClrTypeInfo(writer, clrTypeName, clrAssemblyName);
}
// Update the overloads whenever you are changing this method
internal static void WriteClrTypeInfo(XmlWriterDelegator writer, DataContract dataContract, SerializationBinder binder)
{
if (!dataContract.IsISerializable && !(dataContract is SurrogateDataContract))
{
TypeInformation typeInformation = null;
Type clrType = dataContract.OriginalUnderlyingType;
string clrTypeName = null;
string clrAssemblyName = null;
if (binder != null)
{
binder.BindToName(clrType, out clrAssemblyName, out clrTypeName);
}
if (clrTypeName == null)
{
typeInformation = NetDataContractSerializer.GetTypeInformation(clrType);
clrTypeName = typeInformation.FullTypeName;
}
if (clrAssemblyName == null)
{
clrAssemblyName = (typeInformation == null) ?
NetDataContractSerializer.GetTypeInformation(clrType).AssemblyString :
typeInformation.AssemblyString;
// Throw in the [TypeForwardedFrom] case to prevent a partially trusted assembly from forwarding itself to an assembly with higher privileges
if (!UnsafeTypeForwardingEnabled && !clrType.Assembly.IsFullyTrusted && !IsAssemblyNameForwardingSafe(clrType.Assembly.FullName, clrAssemblyName))
{
throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(XmlObjectSerializer.CreateSerializationException(SR.GetString(SR.TypeCannotBeForwardedFrom, DataContract.GetClrTypeFullName(clrType), clrType.Assembly.FullName, clrAssemblyName)));
}
}
WriteClrTypeInfo(writer, clrTypeName, clrAssemblyName);
}
}