Can we use XMLSerializer for deserializing the data seralized by BinaryFormatter & Soap Formatter?

Question

Hi Team,

**Point #1 :**In our existing code we have used BinaryFormatter to serialize and Deserialize the data.

Looking at our security scan results and lot of places also the vulnerability is being mentioned about use of BinaryFormatter.(CA2300: Do not use insecure deserializer BinaryFormatter)

Is it possible to keep BinaryFormatter Serialize methods as it and can we only use XMLSerilaizer to Deserialize the data serialized by BinaryFormatter?
Or Do you recommend to replace all BinaryFormatter Serialize & DeSeriailize both?

Also please suggest if not XML serailizer what other alternaive we can use , we are serializing the data in byte array.

Sample code:

//Serialize
using (MemoryStream buffer = new MemoryStream())

{

BinaryFormatter formatter = new BinaryFormatter();

formatter.Serialize(buffer, obj);

return buffer.ToArray();

}

////Deserialize

using (MemoryStream buffer = new MemoryStream(bytes))

{

BinaryFormatter formatter = new BinaryFormatter();

return (T)formatter.Deserialize(buffer);

}

Point #2:
Same case forSoapFormatter, whats the best alternative we can use?

I saw lot of articles , if possible can you please post examples of migrations.

Answer 1

It is not possible to use XmlSerializer to deserialize data that has been serialized with BinaryFormatter or SoapFormatter. Each serializer has its own format and structure, which means they are not interchangeable. If you have used BinaryFormatter for serialization, you will need to replace both the serialization and deserialization processes with a different serializer.

Given the security vulnerabilities associated with BinaryFormatter, it is strongly recommended to migrate away from it entirely. You can consider using the following alternatives:

1. System.Text.Json for JSON serialization.
2. DataContractSerializer for XML serialization.
3. MessagePack for a compact binary representation.
4. protobuf-net for another binary serialization option.

If you are currently serializing data into a byte array, both System.Text.Json and DataContractSerializer can handle this, but you will need to adjust your serialization code accordingly.

For SoapFormatter, similar recommendations apply. It is also considered insecure and should be replaced with one of the aforementioned serializers.

---

References:

• Deserialization risks in use of BinaryFormatter and related types
• Choose a serializer
• BinaryFormatter migration guide