Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/fundamentals/code-analysis/quality-rules/ca1801.md
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ This rule does not examine the following kinds of methods:

- Methods used as event handlers.

- Serialization constructors ([see guidelines](../../../standard/serialization/serialization-guidelines.md#supporting-runtime-serialization)).
- Serialization constructors (see [guidelines](../../../standard/serialization/serialization-guidelines.md#runtime-serialization)).

- Serialization <xref:System.Runtime.Serialization.ISerializable.GetObjectData%2A> methods.

Expand Down
10 changes: 5 additions & 5 deletions docs/standard/security/cryptographic-services.md
Original file line number Diff line number Diff line change
Expand Up @@ -173,21 +173,21 @@ None of the previous methods will prevent someone from reading Alice's messages,

## Random Number Generation

Random number generation is integral to many cryptographic operations. For example, cryptographic keys need to be as random as possible so that it is infeasible to reproduce them. Cryptographic random number generators must generate output that is computationally infeasible to predict with a probability that is better than one half. Therefore, any method of predicting the next output bit must not perform better than random guessing. The classes in the .NET Framework use random number generators to generate cryptographic keys.
Random number generation is integral to many cryptographic operations. For example, cryptographic keys need to be as random as possible so that it is infeasible to reproduce them. Cryptographic random number generators must generate output that is computationally infeasible to predict with a probability that is better than one half. Therefore, any method of predicting the next output bit must not perform better than random guessing. The classes in .NET use random number generators to generate cryptographic keys.

The <xref:System.Security.Cryptography.RandomNumberGenerator> class is an implementation of a random number generator algorithm.

## ClickOnce Manifests

In the .NET Framework 3.5, the following cryptography classes let you obtain and verify information about manifest signatures for applications that are deployed using [ClickOnce technology](/visualstudio/deployment/clickonce-security-and-deployment):
The following cryptography classes let you obtain and verify information about manifest signatures for applications that are deployed using [ClickOnce technology](/visualstudio/deployment/clickonce-security-and-deployment):

- The <xref:System.Security.Cryptography.ManifestSignatureInformation> class obtains information about a manifest signature when you use its <xref:System.Security.Cryptography.ManifestSignatureInformation.VerifySignature%2A> method overloads.

- You can use the <xref:System.Security.ManifestKinds> enumeration to specify which manifests to verify. The result of the verification is one of the <xref:System.Security.Cryptography.SignatureVerificationResult> enumeration values.

- The <xref:System.Security.Cryptography.ManifestSignatureInformationCollection> class provides a read-only collection of <xref:System.Security.Cryptography.ManifestSignatureInformation> objects of the verified signatures.

In addition, the following classes provide specific signature information:
In addition, the following classes provide specific signature information:

- <xref:System.Security.Cryptography.StrongNameSignatureInformation> holds the strong name signature information for a manifest.

Expand All @@ -199,11 +199,11 @@ In the .NET Framework 3.5, the following cryptography classes let you obtain and

## Cryptography Next Generation (CNG) Classes

In the .NET Framework 3.5 and later versions, the Cryptography Next Generation (CNG) classes provide a managed wrapper around the native CNG functions. (CNG is the replacement for CryptoAPI.) These classes have "Cng" as part of their names. Central to the CNG wrapper classes is the <xref:System.Security.Cryptography.CngKey> key container class, which abstracts the storage and use of CNG keys. This class lets you store a key pair or a public key securely and refer to it by using a simple string name. The elliptic curve-based <xref:System.Security.Cryptography.ECDsaCng> signature class and the <xref:System.Security.Cryptography.ECDiffieHellmanCng> encryption class can use <xref:System.Security.Cryptography.CngKey> objects.
The Cryptography Next Generation (CNG) classes provide a managed wrapper around the native CNG functions. (CNG is the replacement for CryptoAPI.) These classes have "Cng" as part of their names. Central to the CNG wrapper classes is the <xref:System.Security.Cryptography.CngKey> key container class, which abstracts the storage and use of CNG keys. This class lets you store a key pair or a public key securely and refer to it by using a simple string name. The elliptic curve-based <xref:System.Security.Cryptography.ECDsaCng> signature class and the <xref:System.Security.Cryptography.ECDiffieHellmanCng> encryption class can use <xref:System.Security.Cryptography.CngKey> objects.

The <xref:System.Security.Cryptography.CngKey> class is used for a variety of additional operations, including opening, creating, deleting, and exporting keys. It also provides access to the underlying key handle to use when calling native functions directly.

The .NET Framework 3.5 also includes a variety of supporting CNG classes, such as the following:
.NET also includes a variety of supporting CNG classes, such as the following:

- <xref:System.Security.Cryptography.CngProvider> maintains a key storage provider.

Expand Down
2 changes: 1 addition & 1 deletion docs/standard/security/cryptography-model.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ As an example of the different implementations available for an algorithm, consi
In .NET Framework on Windows:

* `*CryptoServiceProvider` algorithm classes, such as <xref:System.Security.Cryptography.AesCryptoServiceProvider>, are wrappers around the Windows Cryptography API (CAPI) implementation of an algorithm.
* `*Cng` algorithm classes, such as <xref:System.Security.Cryptography.ECDiffieHellmanCng> are wrappers around the Windows Cryptography Next Generation (CNG) implementation.
* `*Cng` algorithm classes, such as <xref:System.Security.Cryptography.ECDiffieHellmanCng>, are wrappers around the Windows Cryptography Next Generation (CNG) implementation.
* `*Managed` classes, such as <xref:System.Security.Cryptography.AesManaged>, are written entirely in managed code. `*Managed` implementations are not certified by the Federal Information Processing Standards (FIPS), and may be slower than the `*CryptoServiceProvider` and `*Cng` wrapper classes.

In .NET Core and .NET 5 and later versions, all implementation classes (`*CryptoServiceProvider`, `*Managed`, and `*Cng`) are wrappers for the operating system (OS) algorithms. If the OS algorithms are FIPS-certified, then .NET uses FIPS-certified algorithms. For more information, see [Cross-Platform Cryptography](cross-platform-cryptography.md).
Expand Down
2 changes: 1 addition & 1 deletion docs/standard/security/how-to-use-data-protection.md
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ ms.assetid: 606698b0-cb1a-42ca-beeb-0bea34205d20

Use the <xref:System.Security.Cryptography.ProtectedData> class to encrypt a copy of an array of bytes. This functionality is available in .NET Framework, .NET Core, and .NET 5. You can specify that data encrypted by the current user account can be decrypted only by the same user account, or you can specify that data encrypted by the current user account can be decrypted by any account on the computer. See the <xref:System.Security.Cryptography.DataProtectionScope> enumeration for a detailed description of <xref:System.Security.Cryptography.ProtectedData> options.

### To encrypt data to a file or stream using data protection
## Encrypt data to a file or stream using data protection

1. Create random entropy.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,16 +1,17 @@
---
title: "<add> Element for <schemaImporterExtensions>"
description: The <add> element adds types used by the XmlSchemaImporter class for mapping XSD types to .NET Framework types.
description: The <add> element adds types used by the XmlSchemaImporter class for mapping XSD types to .NET types.
ms.date: "03/30/2017"
helpviewer_keywords:
- "XML serialization, configuration"
- "<add> element for <schemaImporterExtensions> element"
ms.assetid: c828a558-094b-441e-9065-790b87315fa0
---
# \<add> Element for \<schemaImporterExtensions>
Adds types used by the <xref:System.Xml.Serialization.XmlSchemaImporter> for mapping XSD types to .NET Framework types. For more information about configuration files, see [Configuration File Schema](../../framework/configure-apps/file-schema/index.md).

Adds types used by the <xref:System.Xml.Serialization.XmlSchemaImporter> for mapping XSD types to .NET types. For more information about configuration files, see [Configuration File Schema](../../framework/configure-apps/file-schema/index.md).

\<configuration>
\<configuration>
\<system.xml.serialization>
\<schemaImporterExtensions>
\<add>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ helpviewer_keywords:
- "SOAP, XML serialization"
- "XML serialization, SOAP"
- "XML serialization, attributes"
- "attributes [.NET Framework], XML serialization"
- "attributes [.NET], XML serialization"
- "serialization, attributes"
ms.assetid: 93ee258c-9c0f-4a08-897c-c10db7a00f91
---
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ helpviewer_keywords:
- "classes, serializing"
- "XmlSerializer class, serializing"
- "XML serialization, attributes"
- "attributes [.NET Framework], XML serialization"
- "attributes [.NET], XML serialization"
- "serialization, attributes"
- "XML Schema, serializing"
ms.assetid: 414b820f-a696-4206-b576-2711d85490c7
Expand Down
2 changes: 1 addition & 1 deletion docs/standard/serialization/basic-serialization.md
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ Console.WriteLine("n2: {0}", obj.n2);
Console.WriteLine("str: {0}", obj.str);
```

The <xref:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter> used above is very efficient and produces a compact byte stream. All objects serialized with this formatter can also be deserialized with it, which makes it an ideal tool for serializing objects that will be deserialized on the .NET Framework. It is important to note that constructors are not called when an object is deserialized. This constraint is placed on deserialization for performance reasons. However, this violates some of the usual contracts the runtime makes with the object writer, and developers should ensure that they understand the ramifications when marking an object as serializable.
The <xref:System.Runtime.Serialization.Formatters.Binary.BinaryFormatter> used above is very efficient and produces a compact byte stream. All objects serialized with this formatter can also be deserialized with it, which makes it an ideal tool for serializing objects that will be deserialized on .NET. It is important to note that constructors are not called when an object is deserialized. This constraint is placed on deserialization for performance reasons. However, this violates some of the usual contracts the runtime makes with the object writer, and developers should ensure that they understand the ramifications when marking an object as serializable.

If portability is a requirement, use the <xref:System.Runtime.Serialization.Formatters.Soap.SoapFormatter> instead. Simply replace the **BinaryFormatter** in the code above with **SoapFormatter,** and call **Serialize** and **Deserialize** as before. This formatter produces the following output for the example used above.

Expand Down
4 changes: 2 additions & 2 deletions docs/standard/serialization/binary-serialization.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ Serialization can be defined as the process of storing the state of an object to
When implementing a serialization mechanism in an object-oriented environment, you have to make a number of tradeoffs between ease of use and flexibility. The process can be automated to a large extent, provided you are given sufficient control over the process. For example, situations may arise where simple binary serialization is not sufficient, or there might be a specific reason to decide which fields in a class need to be serialized. The following sections examine the robust serialization mechanism provided with .NET and highlight a number of important features that allow you to customize the process to meet your needs.

> [!NOTE]
> The state of a UTF-8 or UTF-7 encoded object is not preserved if the object is serialized and deserialized using different .NET Framework versions.
> The state of a UTF-8 or UTF-7 encoded object is not preserved if the object is serialized and deserialized using different .NET versions.

[!INCLUDE [binary-serialization-warning](../../../includes/binary-serialization-warning.md)]

Expand Down Expand Up @@ -345,7 +345,7 @@ Describes the XML serialization mechanism that is included with the common langu
Describes the secure coding guidelines to follow when writing code that performs serialization.

- [.NET Remoting](/previous-versions/dotnet/netframework-4.0/72x4h507(v=vs.100))\
Describes the various methods Starting in .NET Framework for remote communications.
Describes the various methods in .NET Framework for remote communications.

- [XML Web Services Created Using ASP.NET and XML Web Service Clients](/previous-versions/dotnet/netframework-4.0/7bkzywba(v=vs.100))\
Articles that describe and explain how to program XML Web services created using ASP.NET.
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,12 @@ helpviewer_keywords:
- "arrays, serializing"
- "XML serialization, attributes"
- "preventing serialization"
- "attributes [.NET Framework], XML serialization"
- "attributes [.NET], XML serialization"
- "serialization, examples"
- "serialization, attributes"
ms.assetid: 47d4c39d-30e1-4c7b-8a2e-301325390647
---
# Controlling XML Serialization Using Attributes
# Control XML serialization using attributes

Attributes can be used to control the XML serialization of an object or to create an alternate XML stream from the same set of classes. For more details about creating an alternate XML stream, see [How to: Specify an Alternate Element Name for an XML Stream](how-to-specify-an-alternate-element-name-for-an-xml-stream.md).

Expand Down
8 changes: 5 additions & 3 deletions docs/standard/serialization/custom-serialization.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,15 +20,17 @@ helpviewer_keywords:
ms.assetid: 12ed422d-5280-49b8-9b71-a2ed129c0384
---
# Custom serialization

Custom serialization is the process of controlling the serialization and deserialization of a type. By controlling serialization, it's possible to ensure serialization compatibility, which is the ability to serialize and deserialize between versions of a type without breaking the core functionality of the type. For example, in the first version of a type, there may be only two fields. In the next version of a type, several more fields are added. Yet the second version of an application must be able to serialize and deserialize both types. The following sections describe how to control serialization.

[!INCLUDE [binary-serialization-warning](../../../includes/binary-serialization-warning.md)]

> [!IMPORTANT]
> In versions previous to .NET Framework 4.0, serialization of custom user data in a partially trusted assembly was accomplished using the GetObjectData. Starting with version 4.0, that method is marked with the <xref:System.Security.SecurityCriticalAttribute> attribute which prevents execution in partially trusted assemblies. To work around this condition, implement the <xref:System.Runtime.Serialization.ISafeSerializationData> interface.
> In versions previous to .NET Framework 4.0, serialization of custom user data in a partially trusted assembly was accomplished using `GetObjectData`. Starting with version 4.0, that method is marked with the <xref:System.Security.SecurityCriticalAttribute> attribute, which prevents execution in partially trusted assemblies. To work around this condition, implement the <xref:System.Runtime.Serialization.ISafeSerializationData> interface.

## Running custom methods during and after serialization
The best practice and easiest way (introduced in version 2.0 of the .NET Framework) is to apply the following attributes to methods that are used to correct data during and after serialization:
## Running custom methods during and after serialization

The recommended way to run custom methods during and after serialization is to apply the following attributes to methods that are used to correct data during and after serialization:

- <xref:System.Runtime.Serialization.OnDeserializedAttribute>

Expand Down
5 changes: 3 additions & 2 deletions docs/standard/serialization/datetimeserialization-element.md
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,10 @@ Determines the serialization mode of <xref:System.DateTime> objects.
|system.xml.serialization|The top-level element for controlling XML serialization.|

## Remarks
In versions 1.0, 1.1, 2.0 and later versions of the .NET Framework, when this property is set to **Local**, <xref:System.DateTime> objects are always formatted as the local time. That is, local time zone information is always included with the serialized data. Set this property to **Local** to ensure compatibility with older versions of the .NET Framework.

When this property is set to **Local**, <xref:System.DateTime> objects are always formatted as the local time. That is, local time zone information is always included with the serialized data.

In version 2.0 and later versions of the .NET Framework that have this property set to **Roundtrip**, <xref:System.DateTime> objects are examined to determine whether they are in the local, UTC, or an unspecified time zone. The <xref:System.DateTime> objects are then serialized in such a way that this information is preserved. This is the default behavior and is the recommended behavior for all new applications that do not communicate with older versions of the framework.
When this property is set to **Roundtrip**, <xref:System.DateTime> objects are examined to determine whether they are in the local, UTC, or an unspecified time zone. The <xref:System.DateTime> objects are then serialized in such a way that this information is preserved. This is the default behavior and is the recommended behavior for all new applications that do not communicate with older versions of the framework.

## See also

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ helpviewer_keywords:
---
# How to determine if a .NET Standard object is serializable

.NET Standard is a specification that defines the types and members that must be present on specific .NET implementations that conform to that version of the standard. However, .NET Standard does not define whether a type is serializable. The types defined in the .NET Standard Library are not marked with the <xref:System.SerializableAttribute> attribute. Instead, specific .NET implementations, such as the .NET Framework and .NET Core, are free to determine whether a particular type is serializable.
.NET Standard is a specification that defines the types and members that must be present on specific .NET implementations that conform to that version of the standard. However, .NET Standard does not define whether a type is serializable. The types defined in the .NET Standard Library are not marked with the <xref:System.SerializableAttribute> attribute. Instead, specific .NET implementations, such as .NET Framework and .NET Core, are free to determine whether a particular type is serializable.

If you've developed a library that targets .NET Standard, your library can be consumed by any .NET implementation that supports .NET Standard. This means that you cannot know in advance whether a particular type is serializable; you can only determine whether it is serializable at run time.

Expand Down
Loading