LA0206: Aspect Class Uses Binary Serialization


Severity	Error
Reported by	PostSharp
Message	Aspect "<AspectType>" is annotated with [Serializable]. Using [Serializable] on aspects is not supported because it requires BinaryFormatter at run time. BinaryFormatter is considered dangerous, and using it can cause an exception at run time depending on the run-time settings. Use [PSerializable] instead. If you are certain that you need [Serializable], set the PostSharpBinaryFormatterAllowed MSBuild property to True to suppress this message. See https://bit.ly/ps-binary-formatter for more information.

Cause

PostSharp creates the aspect instances at build time and serializes them into the assembly. It chooses the serializer from the aspect class. When the aspect class has neither a serializer of its own nor the [PSerializableAttribute] attribute, but has the [SerializableAttribute] attribute, the aspect would be deserialized at run time with BinaryFormatter. Microsoft considers BinaryFormatter insecure, and recent versions of .NET throw an exception when it is used, so PostSharp reports LA0206 on the aspect class <AspectType> unless the PostSharpBinaryFormatterAllowed MSBuild property is True.

In the following example, the [Log] aspect has the [SerializableAttribute] attribute.

Full screen

using System;
using PostSharp.Aspects;
using PostSharp.Serialization;

namespace Errors.LA0206_Error;

// The aspect would be serialized with BinaryFormatter.
[Serializable]
public class LogAttribute : OnMethodBoundaryAspect
{
    public override void OnEntry( MethodExecutionArgs args )
    {
        Console.WriteLine( $"Entering {args.Method.Name}." );
    }
}

public class OrderService
{
    [Log]
    public void PlaceOrder( string product )
    {
        Console.WriteLine( $"Order placed for {product}." );
    }
}

public static class Program
{
    public static void Main()
    {
        new OrderService().PlaceOrder( "Coffee" );
    }
}

Full screen

error LA0206: LA0206_Error.cs(9,14): Aspect "Errors.LA0206_Error.LogAttribute" is annotated with [Serializable]. Using [Serializable] on aspects is not supported because it requires BinaryFormatter at run time. BinaryFormatter is considered dangerous, and using it can cause an exception at run time depending on the run-time settings. Use [PSerializable] instead. If you are certain that you need [Serializable], set the PostSharpBinaryFormatterAllowed MSBuild property to True to suppress this message. See https://bit.ly/ps-binary-formatter for more information.

Resolution

Replace [SerializableAttribute] with [PSerializableAttribute] on the aspect class, and on the classes of its serialized fields. Replace [NonSerializedAttribute] with [PNonSerializedAttribute].
Only for a legacy application that cannot change its aspects, set the PostSharpBinaryFormatterAllowed MSBuild property to True. This is not recommended: see BinaryFormatter Security for the steps that the run time then requires.

In the following example, the [Log] aspect has the [PSerializableAttribute] attribute.

Full screen

using System;
using PostSharp.Aspects;
using PostSharp.Serialization;

namespace Errors.LA0206_Fixed;

// The aspect is serialized with the portable serializer of PostSharp.
[PSerializable]
public class LogAttribute : OnMethodBoundaryAspect
{
    public override void OnEntry( MethodExecutionArgs args )
    {
        Console.WriteLine( $"Entering {args.Method.Name}." );
    }
}

public class OrderService
{
    [Log]
    public void PlaceOrder( string product )
    {
        Console.WriteLine( $"Order placed for {product}." );
    }
}

public static class Program
{
    public static void Main()
    {
        new OrderService().PlaceOrder( "Coffee" );
    }
}

Full screen

Entering PlaceOrder.
Order placed for Coffee.

Cause

Resolution

See Also