Safe Deserialization

• Nov 24, 2020

DevExpress controls use a safety mechanism for all deserialization operations to improve security. An exception is thrown if a control attempts to load an unsafe type.

Deserialize Trusted Types

You should review all unsafe type exceptions. If you trust a certain type, use the following code to enable deserialization:

C#

DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(typeof(CustomClass)); 

VB.NET

DevExpress.Utils.DeserializationSettings.RegisterTrustedClass(GetType(CustomClass)) 

Call the following method to trust all types from a specific assembly:

C#

DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly("CustomAssembly, Version=x.x.x.x, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxxx");  
DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly(typeof(CustomClass).Assembly);  

VB.NET

DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly("CustomAssembly, Version=x.x.x.x, Culture=neutral, PublicKeyToken=xxxxxxxxxxxxxxxx")  
DevExpress.Utils.DeserializationSettings.RegisterTrustedAssembly(GetType(CustomClass).Assembly)  

Trust a Part of Your Code

If you trust a data source that raises a security exception, you can turn off safe deserialization for certain sections of code:

C#

DevExpress.Utils.DeserializationSettings.InvokeTrusted(()=>{  
    // Trusted deserialization.  
    // gridView1.RestoreLayoutFromXml(fileName);  
}); 

VB.NET

DevExpress.Utils.DeserializationSettings.InvokeTrusted(  
    Sub()  
        ' Trusted deserialization.  
        ' GridView1.RestoreLayoutFromXml(fileName)  
    End Sub  
)