CA2240: Implement ISerializable correctly
Note
This article applies to Visual Studio 2015. If you're looking for the latest Visual Studio documentation, see Visual Studio documentation. We recommend upgrading to the latest version of Visual Studio. Download it here
| Item | Value |
|---|---|
| TypeName | ImplementISerializableCorrectly |
| CheckId | CA2240 |
| Category | Microsoft.Usage |
| Breaking Change | Non Breaking |
Cause
An externally visible type is assignable to the System.Runtime.Serialization.ISerializable interface and one of the following conditions is true:
The type inherits but does not override the System.Runtime.Serialization.ISerializable.GetObjectData method and the type declares instance fields that are not marked with the System.NonSerializedAttribute attribute.
The type is not sealed and the type implements a GetObjectData method that is not externally visible and overridable.
Rule Description
Instance fields that are declared in a type that inherits the System.Runtime.Serialization.ISerializable interface are not automatically included in the serialization process. To include the fields, the type must implement the GetObjectData method and the serialization constructor. If the fields should not be serialized, apply the NonSerializedAttribute attribute to the fields to explicitly indicate the decision.
In types that are not sealed, implementations of the GetObjectData method should be externally visible. Therefore, the method can be called by derived types, and is overridable.
How to Fix Violations
To fix a violation of this rule, make the GetObjectData method visible and overridable and make sure all instance fields are included in the serialization process or explicitly marked with the NonSerializedAttribute attribute.
When to Suppress Warnings
Do not suppress a warning from this rule.
Example
The following example shows two serializable types that violate the rule.
using namespace System;
using namespace System::Security::Permissions;
using namespace System::Runtime::Serialization;
namespace Samples1
{
// Violates this rule
[Serializable]
public ref class Book : ISerializable
{
private:
initonly String^ _Title;
public:
Book(String^ title)
{
if (title == nullptr)
throw gcnew ArgumentNullException("title");
_Title = title;
}
property String^ Title
{
String^ get()
{
return _Title;
}
}
protected:
Book(SerializationInfo^ info, StreamingContext context)
{
if (info == nullptr)
throw gcnew ArgumentNullException("info");
_Title = info->GetString("Title");
}
private:
[SecurityPermission(SecurityAction::LinkDemand, Flags = SecurityPermissionFlag::SerializationFormatter)]
void virtual GetObjectData(SerializationInfo^ info, StreamingContext context) sealed = ISerializable::GetObjectData
{
if (info == nullptr)
throw gcnew ArgumentNullException("info");
info->AddValue("Title", _Title);
}
};
// Violates this rule
[Serializable]
public ref class LibraryBook : Book
{
initonly DateTime _CheckedOut;
public:
LibraryBook(String^ title, DateTime checkedOut) : Book(title)
{
_CheckedOut = checkedOut;
}
property DateTime CheckedOut
{
DateTime get()
{
return _CheckedOut;
}
}
};
}
using System;
using System.Security.Permissions;
using System.Runtime.Serialization;
namespace Samples1
{
// Violates this rule
[Serializable]
public class Book : ISerializable
{
private readonly string _Text;
public Book(string text)
{
if (text == null)
throw new ArgumentNullException("text");
_Text = text;
}
protected Book(SerializationInfo info, StreamingContext context)
{
if (info == null)
throw new ArgumentNullException("info");
_Text = info.GetString("Text");
}
public string Text
{
get { return _Text; }
}
[SecurityPermission(SecurityAction.Demand, SerializationFormatter = true)]
public void GetObjectData(SerializationInfo info, StreamingContext context)
{
if (info == null)
throw new ArgumentNullException("info");
info.AddValue("Text", _Text);
}
}
// Violates this rule
[Serializable]
public class LibraryBook : Book
{
private readonly DateTime _CheckedOut;
public LibraryBook(string text, DateTime checkedOut)
: base(text)
{
_CheckedOut = checkedOut;
}
public DateTime CheckedOut
{
get { return _CheckedOut; }
}
}
}
Imports System
Imports System.Security.Permissions
Imports System.Runtime.Serialization
Namespace Samples1
' Violates this rule
<Serializable()> _
Public Class Book
Implements ISerializable
Private ReadOnly _Title As String
Public Sub New(ByVal title As String)
If (title Is Nothing) Then Throw New ArgumentNullException("title")
_Title = title
End Sub
Protected Sub New(ByVal info As SerializationInfo, ByVal context As StreamingContext)
If (info Is Nothing) Then Throw New ArgumentNullException("info")
_Title = info.GetString("Title")
End Sub
Public ReadOnly Property Title() As String
Get
Return _Title
End Get
End Property
<SecurityPermissionAttribute(SecurityAction.LinkDemand, Flags:=SecurityPermissionFlag.SerializationFormatter)> _
Public Sub GetObjectData(ByVal info As SerializationInfo, ByVal context As StreamingContext) _
Implements ISerializable.GetObjectData
If (info Is Nothing) Then Throw New ArgumentNullException("info")
info.AddValue("Title", _Title)
End Sub
End Class
' Violates this rule
<Serializable()> _
Public Class LibraryBook
Inherits Book
Private ReadOnly _CheckedOut As Date
Public Sub New(ByVal text As String, ByVal checkedOut As Date)
MyBase.New(text)
_CheckedOut = checkedOut
End Sub
Public ReadOnly Property CheckedOut() As Date
Get
Return _CheckedOut
End Get
End Property
End Class
End Namespace
Example
The following example fixes the two previous violations by providing an overrideable implementation of [ISerializable.GetObjectData]() on the Book class and by providing an implementation of on the Library class.
using namespace System;
using namespace System::Security::Permissions;
using namespace System::Runtime::Serialization;
namespace Samples2
{
[Serializable]
public ref class Book : ISerializable
{
private:
initonly String^ _Title;
public:
Book(String^ title)
{
if (title == nullptr)
throw gcnew ArgumentNullException("title");
_Title = title;
}
property String^ Title
{
String^ get()
{
return _Title;
}
}
protected:
Book(SerializationInfo^ info, StreamingContext context)
{
if (info == nullptr)
throw gcnew ArgumentNullException("info");
_Title = info->GetString("Title");
}
[SecurityPermission(SecurityAction::LinkDemand, Flags = SecurityPermissionFlag::SerializationFormatter)]
void virtual GetObjectData(SerializationInfo^ info, StreamingContext context) = ISerializable::GetObjectData
{
if (info == nullptr)
throw gcnew ArgumentNullException("info");
info->AddValue("Title", _Title);
}
};
[Serializable]
public ref class LibraryBook : Book
{
initonly DateTime _CheckedOut;
public:
LibraryBook(String^ title, DateTime checkedOut)
: Book(title)
{
_CheckedOut = checkedOut;
}
property DateTime CheckedOut
{
DateTime get()
{
return _CheckedOut;
}
}
protected:
LibraryBook(SerializationInfo^ info, StreamingContext context) : Book(info, context)
{
_CheckedOut = info->GetDateTime("CheckedOut");
}
[SecurityPermission(SecurityAction::LinkDemand, Flags = SecurityPermissionFlag::SerializationFormatter)]
void virtual GetObjectData(SerializationInfo^ info, StreamingContext context) override
{
Book::GetObjectData(info, context);
info->AddValue("CheckedOut", _CheckedOut);
}
};
}
using System;
using System.Security.Permissions;
using System.Runtime.Serialization;
namespace Samples2
{
[Serializable]
public class Book : ISerializable
{
private readonly string _Title;
public Book(string title)
{
if (title == null)
throw new ArgumentNullException("title");
_Title = title;
}
protected Book(SerializationInfo info, StreamingContext context)
{
if (info == null)
throw new ArgumentNullException("info");
_Title = info.GetString("Title");
}
public string Title
{
get { return _Title; }
}
[SecurityPermission(SecurityAction.Demand, SerializationFormatter = true)]
protected virtual void GetObjectData(SerializationInfo info, StreamingContext context)
{
info.AddValue("Title", _Title);
}
[SecurityPermission(SecurityAction.LinkDemand, Flags = SecurityPermissionFlag.SerializationFormatter)]
void ISerializable.GetObjectData(SerializationInfo info, StreamingContext context)
{
if (info == null)
throw new ArgumentNullException("info");
GetObjectData(info, context);
}
}
[Serializable]
public class LibraryBook : Book
{
private readonly DateTime _CheckedOut;
public LibraryBook(string title, DateTime checkedOut)
: base(title)
{
_CheckedOut = checkedOut;
}
protected LibraryBook(SerializationInfo info, StreamingContext context)
: base(info, context)
{
_CheckedOut = info.GetDateTime("CheckedOut");
}
public DateTime CheckedOut
{
get { return _CheckedOut; }
}
[SecurityPermission(SecurityAction.Demand, SerializationFormatter = true)]
protected override void GetObjectData(SerializationInfo info, StreamingContext context)
{
base.GetObjectData(info, context);
info.AddValue("CheckedOut", _CheckedOut);
}
}
}
Imports System
Imports System.Security.Permissions
Imports System.Runtime.Serialization
Namespace Samples2
<Serializable()> _
Public Class Book
Implements ISerializable
Private ReadOnly _Title As String
Public Sub New(ByVal title As String)
If (title Is Nothing) Then Throw New ArgumentNullException("title")
_Title = title
End Sub
Protected Sub New(ByVal info As SerializationInfo, ByVal context As StreamingContext)
If (info Is Nothing) Then Throw New ArgumentNullException("info")
_Title = info.GetString("Title")
End Sub
Public ReadOnly Property Title() As String
Get
Return _Title
End Get
End Property
<SecurityPermissionAttribute(SecurityAction.LinkDemand, Flags:=SecurityPermissionFlag.SerializationFormatter)> _
Protected Overridable Sub GetObjectData(ByVal info As SerializationInfo, ByVal context As StreamingContext) _
Implements ISerializable.GetObjectData
If (info Is Nothing) Then Throw New ArgumentNullException("info")
info.AddValue("Title", _Title)
End Sub
End Class
<Serializable()> _
Public Class LibraryBook
Inherits Book
Private ReadOnly _CheckedOut As Date
Public Sub New(ByVal text As String, ByVal checkedOut As Date)
MyBase.New(text)
_CheckedOut = checkedOut
End Sub
Protected Sub New(ByVal info As SerializationInfo, ByVal context As StreamingContext)
MyBase.New(info, context)
_CheckedOut = info.GetDateTime("CheckedOut")
End Sub
Public ReadOnly Property CheckedOut() As Date
Get
Return _CheckedOut
End Get
End Property
<SecurityPermissionAttribute(SecurityAction.LinkDemand, Flags:=SecurityPermissionFlag.SerializationFormatter)> _
Protected Overrides Sub GetObjectData(ByVal info As System.Runtime.Serialization.SerializationInfo, _
ByVal context As System.Runtime.Serialization.StreamingContext)
MyBase.GetObjectData(info, context)
info.AddValue("CheckedOut", _CheckedOut)
End Sub
End Class
End Namespace
Related Rules
CA2236: Call base class methods on ISerializable types
CA2229: Implement serialization constructors
CA2238: Implement serialization methods correctly
CA2235: Mark all non-serializable fields
CA2237: Mark ISerializable types with SerializableAttribute