GeneratedRegex generated class missing [Serializable] attribute

[Luciden]

Description

Our security scans are reporting that the generated class implements ISerializable (via RegEx subclass) but fails to add the [Serializable] attribute.

Reproduction Steps

Implement the GeneratedRegEx attribute like the following:

[GeneratedRegex(@"^\d+(?:,\d+)*$", RegexOptions.IgnoreCase, "en-US")]
public static partial Regex CommaSeperatedNumericList();

Note generated class lacks the [Serializable] attribute.

[GeneratedCodeAttribute("System.Text.RegularExpressions.Generator", "8.0.9.8001")]
file sealed class CommaSeperatedNumericList_0 : Regex

Expected behavior

The generated class should have the [Serializable] attribute.

Actual behavior

The generated class lacks the [Serializable] attribute.

Regression?

Unknown. First time implementing in .Net 8

Known Workarounds

No response

Configuration

• net8.0
• Windows 11 and Windows Server 16
• x64
• Unknown
• Not using Blazor

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-text-regularexpressions
See info in area-owners.md if you want to be subscribed.

[stephentoub]

Our security scans

Using what tool?

The base Regex still inherits ISerializable because removing it would be a binary breaking change, but if you try to serialize/deserialize a Regex, you'll get a PlatformNotSupportedException. And Regex itself is not marked [Serializable].

We will not be making Regex or source-generated derivations [Serializable].

[Luciden]

We're using Fortify. Are you saying that the interface can't be removed in the next major version?

The Finding:
RegexGenerator_gFE7AE3618D9F1D79C2B253C9FF91651C3F6D8A873BFDCE6DDFEEFD45FD0E50831__CommaSeperatedNumericList_0 implements the ISerializable interface but does not declare the [Serializable] attribute, so it will not be serialized.

The description is as follows:
The .NET runtime will permit the serialization of any object that declares the [Serializable] attribute. If the class can be serialized using the default serialization methods defined by the .NET framework, this is both necessary and sufficient for the object to be correctly serialized. If the class requires custom serialization methods, it must also implement the ISerializable interface. However, the class must still declare the [Serializable] attribute.

[stephentoub]

Are you saying that the interface can't be removed in the next major version?

Correct. Regex itself hasn't been [Serializable] in any version of .NET Core, going back almost a decade at this point, but it still inherits the interface because any binary that did ISerializable s = regex; would otherwise no longer work. If you look at the implementation of the interface, though, you'll see that the interface members throw PlatformNotSupportedException. The source-generated regex instances are not adding an ISerializable implementation; they're just deriving from Regex. Regex is not alone here; most [Serializable] types were made non-serializable in .NET Core; the attribute was removed, but the interface inheritance remained.

We're using Fortify.

Seems like Fortify should be improved here.

[Luciden]

I agree. In fact you've helped me to have enough to submit a bug on there side. Thank you.

[stephentoub]

Thanks.

[huoyaoyuan]

Also note that SerializableAttribute and ISerializable no longer have meaning to .NET Runtime.

If the class can be serialized using the default serialization methods defined by the .NET framework

The binary serializer is deprecated now, and totally removed starting from .NET 9. See more at https://github.com/dotnet/designs/blob/main/accepted/2020/better-obsoletion/binaryformatter-obsoletion.md