BinaryFormatter not supported in .net 5 app when loading Bitmap resource

Question

I have migrated a couple of ASP.Net Core 2.2 projects to .Net 5, the last issue I have is that I get a System.NotSupported exception when trying to load bitmaps from the project resources.

RtfUtility.AppendLogo(result, Properties.Resources.Logo);

System.NotSupportedException HResult=0x80131515 Message=BinaryFormatter serialization and deserialization are disabled within this application. See https://aka.ms/binaryformatter for more information. Source=System.Runtime.Serialization.Formatters

I'm not using BinaryFormatter explicitly but oddly I don't get an error when loading a binary PDF file in the same way:

processor.LoadDocument(new MemoryStream(Properties.Resources.Certificate));

Both mechanisms use ResourceManager.GetObject, so I'm not sure whats going on. I know I can turn off the error in the project file, but that seems to be a short term solution, I'd rather fix it and forget it. Thanks for any advice you can give...

Edit:

Stack Trace is below, The error is not caused by the library, it is when accessing the resource. It happens when the image is embedded or linked - seems to make no difference, but doesn't happen with a (binary) PDF file.

Thanks for looking at this...

at System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Deserialize(Stream serializationStream) at System.Resources.ResourceReader.<>c__DisplayClass7_0`1.b__0(Object obj, Stream stream) at System.Resources.ResourceReader.DeserializeObject(Int32 typeIndex) at System.Resources.ResourceReader._LoadObjectV2(Int32 pos, ResourceTypeCode& typeCode) at System.Resources.ResourceReader.LoadObjectV2(Int32 pos, ResourceTypeCode& typeCode) at System.Resources.ResourceReader.LoadObject(Int32 pos, ResourceTypeCode& typeCode) at System.Resources.RuntimeResourceSet.GetObject(String key, Boolean ignoreCase, Boolean isString) at System.Resources.RuntimeResourceSet.GetObject(String key, Boolean ignoreCase) at System.Resources.ResourceManager.GetObject(String name, CultureInfo culture, Boolean wrapUnmanagedMemStream) at System.Resources.ResourceManager.GetObject(String name, CultureInfo culture) at Project.Infrastructure.Properties.Resources.get_Logo() in C:\Development\Project\Project.Infrastructure\Properties\Resources.Designer.cs:line 227 at Project.Infrastructure.Models.ShowWording.Generate() in C:\Development\Project\Project.Infrastructure\Models\ShowWording.cs:line 146

Answer 1

BinaryFormatter serialization methods are obsolete and prohibited in ASP.NET apps. However, the article does not say anything about the resourceReader or other classes, even if the same security warning applies.

So I would presume that this is a bug. At a minimum I would have expected the documentation to explicitly state that binary resources are not supported, or any other compatibility constraints. I would consider creating a minimal reproducible example to ensure there is no other weird build issue causing the problem, and posting a bug report about it.

Note that there seem to be various issues reported about binary resources in .net core, but it is unclear to me what the final resolution is.

As a workaround there is an option to re enable binaryformatter in .Net 5 asp.Net apps by adding the following to the project file.

<PropertyGroup>
  <TargetFramework>net5.0</TargetFramework>
  <!-- Warning: Setting the following switch is *NOT* recommended in web apps. -->
  <EnableUnsafeBinaryFormatterSerialization>true</EnableUnsafeBinaryFormatterSerialization>
</PropertyGroup>