polymorphic serialization/deserialization in System.Text.Json

[smartouss]

I'm developing a library that will generate api at the end and this api will need to deserialize an interface as a result, so the types is not known yet and i don't want to add a headache for mapping types in startups, this library is very disappointing and unusable as it add a lot of dependency and logic to and from the serializer to the code, i think it still need a lot of work and the problem is its used by default and forced by microsoft in my places.

Is there a way to do this?

[Clockwork-Muse]

Yes, it's possible, starting with .NET 7.

[Xyncgas]

why not just use virtual, overriding serialization by derive class, or using reflecting inside the interface to find the proper way to serialize the object which is implemented in derived clas

[smartouss]

The provided link suggest to add the known type as an attributes to the base class which is not possible in my case, and this way kill the polymorphism with oop and the ability to expose extensibility point and work with unknown type which make this serializer unusable in this case, is there another way than the one mentioned in the link?

[krwq]

You can use contract customization to dynamically find list of allowed derived types but that can only be safe assuming you trust them all which generally speaking is wrong assumption if you're not the only person developing those classes.

What you're looking for is something along the lines of:

JsonSerialializerOptions options = new()
{
  TypeInfoResolver = new DefaultJsonTypeInfoResolver()
  {
    Modifiers =
    {
      (JsonTypeInfo typeInfo) =>
      {
          if (typeInfo.Type == typeof(YourInterfaceType))
          {
              // your code goes here
          }
      }
    }
  }
};

In the modifier code you need to adjust https://docs.microsoft.com/en-us/dotnet/api/system.text.json.serialization.metadata.jsontypeinfo.polymorphismoptions?view=net-7.0#system-text-json-serialization-metadata-jsontypeinfo-polymorphismoptions accordingly to your expectations

[smartouss]

Yes i did something like that which i will need to register the known type at startup but it will add more headache for mapping, not always you need to know what class is implementing your interface specially if you developing a library for use outside your project and here is the issue

[krwq]

if we allow to specify type in the untrusted payload without explicit list what's allowed that's remote code execution on deserialization.

[smartouss]

yes but its not always known, like in case if developing a library, registering and defining the types should be easier than setting an attribute as its not always an option

[AartBluestoke]

@smartouss - just reiterating krwq, unbounded type targeting in json is a trivial remote code execute - just don't allow it, or you're 1 malicious json message from your server installing a bitcoin miner or worse.
5 seconds of google found me https://vbscrub.com/2020/02/05/net-deserialization-exploits-explained/
{ '$type':'System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35', 'MethodName':'Start', 'MethodParameters':{ '$type':'System.Collections.ArrayList, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089', '$values':['cmd.exe','/c calc.exe'] }, 'ObjectInstance':{'$type':'System.Diagnostics.Process, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'} }

[TruePluto]

Why JsonDerivedType and typeDiscriminator should set on base type.
Raw Code

[JsonDerivedType(typeof(WeatherForecastBase), typeDiscriminator: "base")]
[JsonDerivedType(typeof(WeatherForecastWithCity), typeDiscriminator: "withCity")]
public class WeatherForecastBase
{
    public DateTimeOffset Date { get; set; }
    public int TemperatureCelsius { get; set; }
    public string? Summary { get; set; }
}

public class WeatherForecastWithCity : WeatherForecastBase
{
    public string? City { get; set; }
}

I want to set on derived class

[TypeDiscriminator("base")]
public class WeatherForecastBase
{
    public DateTimeOffset Date { get; set; }
    public int TemperatureCelsius { get; set; }
    public string? Summary { get; set; }
}

[JsonDerivedType("withCity")]
public class WeatherForecastWithCity : WeatherForecastBase
{
    public string? City { get; set; }
}

[krwq]

cc: @eiriktsarpalis

[eiriktsarpalis]

It's by design, polymorphism configuration is always scoped to the type you're applying the attribute to. If you don't have access to the base type you can always modify the configuration using the contract model:

https://learn.microsoft.com/en-us/dotnet/standard/serialization/system-text-json/polymorphism?pivots=dotnet-7-0#configure-polymorphism-with-the-contract-model