Replace binary formatter

[rchauhan18]

Description

The Binary Formatter was initially developed prior to the comprehensive understanding of deserialization vulnerabilities as a significant threat. As a result, the code doesn’t follow the modern practices. Due to the security vulnerability Binary formatter is considered obsolete. In .NET 9.0, the entire Binary formatter infrastructure will be removed from the product.

Binary Reader and Writer can be used to read and write the primitive data types into binary data and does not have any security vulnerability. We are creating a safe handle ‘BinaryFormatWriter’ which handles all primitives, Enums, strings, arrays and lists of primitives, and other items before falling into the process of serialization/deserialization. For serialization/deserialization we will use Binary writer. This approach will allow us to disable Binary formatter for the primitive and some other cases.
To convert the object to binary data we call TryWriteFrameworkObject with a memory stream and the object.
BinaryFormattedObject class is added to parse a binary formatted object from a stream. It used Binary reader to read from a stream.
This solution is similar as in WinForms
PR: dotnet/winforms#9088
CC
@JeremyKuhne @lonitra

Customer Impact

In .NET 9.0, the entire Binary formatter infrastructure will be removed from the product, and it will become obsolete.
It has additional benefits of making applications more friendly to linker trimming.

Regression

N/A

Testing

Internal testing done.

Risk

Low
There might be a few instances where this solution won't be effective. Currently, this PR includes all the primitive types and few more data types. The plan is to handle additional cases as feedback comes in.

Microsoft Reviewers: Open in CodeFlow

[JeremyKuhne]

To be clear, BinaryFormatter APIs will never be removed. Setting a switch in .NET 9 to enable the BinaryFormatter will likely become required for WPF and WinForms (as it is already for all other .NET projects in .NET 8). Enabling the functionality will possibly require additional steps in the future, but the surface area should always be there.

[wjk]

To be clear, BinaryFormatter APIs will never be removed.

Then it is my mistake for misunderstanding the “Customer Impact” section of the OP. Sorry to bother you.

[michmela44]

To be clear, BinaryFormatter APIs will never be removed.

While the APIs may never be removed, according to BinaryFormatter infrastructure removed from .NET (.NET 9), "The internal BinaryFormatter implementation will no longer exist in .NET in any form and cannot be reenabled through any compat switch."

[JeremyKuhne]

To be clear, BinaryFormatter APIs will never be removed.

While the APIs may never be removed, according to BinaryFormatter infrastructure removed from .NET (.NET 9), "The internal BinaryFormatter implementation will no longer exist in .NET in any form and cannot be reenabled through any compat switch."

The hope is to make you jump through more hoops by putting the actual implementation in another package, but there is no way the API will be removed or there will be no way to re-enable for quite some time. It is fundamental to many existing applications, particularly WinForms.

To be clear, one should avoid the BinaryFormatter if at all possible, but as a platform we will not completely abandon existing users of this functionality.

[JeremyKuhne]

This looks good. You should consider ensuring you have test coverage with and without the BinaryFormatter being enabled. See https://github.com/dotnet/winforms/blob/main/src/Common/tests/TestUtilities/BinaryFormatterScope.cs for how we do this in WinForms.

[rchauhan18]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rchauhan18]

/azp run

[azure-pipelines]

Azure Pipelines failed to run 1 pipeline(s).

[JeremyKuhne]

Looks good, you'll want to make sure to manually test that handled types work without the BinaryFormatter.

[rchauhan18]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).