Legacy
Definition
Assembly: Gemstone.PhasorProtocols (in Gemstone.PhasorProtocols.dll) Version: 1.0.181 -- Release Build+69c74c3448bebb1c8c739a856f2a43b00db6d500
public static class LegacySoapDeserializerPublic NotInheritable Class LegacySoapDeserializerpublic ref class LegacySoapDeserializer abstract sealedGemstone.PhasorProtocols.LegacySoapDeserializer = function();
Type.createClass(
'Gemstone.PhasorProtocols.LegacySoapDeserializer');- Inheritance
- Object LegacySoapDeserializer
Remarks
.NET Core / .NET 5+ does not ship SoapFormatter, and existing third-party ports have limitations with interface-typed object references and circular graphs. This deserializer targets the specific dialect of SOAP emitted by .NET Framework's SoapFormatter against ISerializable types — flat SOAP-ENV:Body, id/href reference resolution, and CLR nsassem namespace URIs.
The deserializer pre-allocates every object node via GetUninitializedObject(Type) before invoking any deserialization constructor, so circular references (parent/child) resolve to stable instance identities even though some constructors may not yet have run. Each (SerializationInfo, StreamingContext) constructor is invoked on the already-allocated instance via a compiled DynamicMethod.
Security: like any ISerializable-based reader, materializing an attacker-named type and running its deserialization constructor is the mechanism behind the deserialization-gadget attacks that led to BinaryFormatter/SoapFormatter being deprecated. To contain this, the reader defaults to SafeBinder, which only resolves types from the phasor-protocol assemblies and fails closed for everything else before any object is allocated or any constructor runs. The XML is also parsed with DTD processing prohibited and external entity resolution disabled (no XXE/DTD bombs). Callers that genuinely need broader type resolution can pass LegacyBinder explicitly, but should only do so for fully trusted input.
Properties
| SafeBinder | Default SerializationBinder used by Deserialize(Stream, SerializationBinder). Applies the same legacy GSF.* → Gemstone.* name translation as LegacyBinder, then enforces an allowlist so that only phasor-protocol configuration types can be materialized. Any type that resolves outside the allowed assemblies is rejected (returns null), which causes deserialization to fail closed before the type is allocated or its deserialization constructor runs. This neutralizes deserialization-gadget attacks while preserving full read compatibility for legitimate configuration files. |
Methods
| Deserialize | Deserializes a SOAP-formatted XML graph from stream. |