Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for updated exception serialization using Data Contract Serilializer #1451

Closed
WhitWaldo opened this issue Jan 23, 2025 · 1 comment
Assignees
Milestone

Comments

@WhitWaldo
Copy link
Contributor

WhitWaldo commented Jan 23, 2025

Describe the proposal

As use of the binary formatter is no longer recommended for exception deserialization because of security risks, the data contract serializer has been updated to include its own serializer for handling exceptions. Service Fabric handled a migration to the new serializer itself and documented the change here.

While Dapr Actor support serialization using both data contract and JSON, the latter bits are relatively new. As the data contract approach has been in broad use since actors were added to Dapr and there may very well be developers that simply cannot migrate to the JSON serialization approach, nor do we collect any data providing insight into usage either way, it seems prudent that we look into supporting the new data contract serialization approach for exceptions so as to mitigate the security risks inherent to this older (and likely more commonly used serialization approach).

Edit: As of writing this, it was unclear whether the Dapr Actors had accommodated the migration from the BinaryFormatter or not for its exception deserialization handling, but I wanted to put a note up to so I would remember to dig into it. I've investigated the matter and this mitigation has already been handled in the past, so there's nothing more necessary to do here.

@WhitWaldo WhitWaldo added this to the Future milestone Jan 23, 2025
@WhitWaldo
Copy link
Contributor Author

I've confirmed that Dapr is not using the BinaryFormatter for any exception serialization purposes today and that our implementation uses the DataContractSerializer for XML object graphics per the advice shared in the latest version of the security guidance as seen in the code here.

@WhitWaldo WhitWaldo modified the milestones: Future, v1.16 Jan 24, 2025
@WhitWaldo WhitWaldo self-assigned this Jan 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant