You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Unable to serialize standalone polymorphic type or collection #171
I'm using the Redis MsgPack wrapper, but I've tried this separately using the raw MsgPack SDK as well.
I have a simple polymorphic type hierarchy e.g.
typeAnimal= Cat | Dog
etc. etc., and I want to serialize a list of animals. The problem is that it appears that you need to enclose the list in a type e.g.
typeData={ Animals = ResizeArray<Animal>}
and then place an set of attributes on that property with all of the possible subclasses (or try one of the Runtime attributes).
There are several we face with this approach: -
Every property on every type that has a List of Animal has to have the same attribute / attributes (or perhaps we need to create a custom List that subclasses List etc.). This means attributes all over our types etc.
The bigger issue that is we need to create an enclosing type with a single property just to place the serialization polymorphism information. We should be able to store this information on the types themselves, and / or have a mechanism to do this lookup (similar to how JSON .Net works).
It is a good question. Your understanding is absolutely right.
I did not enable polymorphism related attribute for types themselves because of following reason:
Simply I could not imagine the use-case not like you. In this point, your argument is reasonable.
Just after I released the polymorphism, CVE-2015-4852 was found. I think we should be cautious to open subtype deserialization because we can misuse it easily. Although I think explicitly attribute based approach is enough secure, but I need more discussion for it.
Do you have any opinion for above? It is hard to implement in 0.7.0 soon, but it can be implemented in 0.8 release.
Activity
yfakariya commentedon Jun 26, 2016
It is a good question. Your understanding is absolutely right.
I did not enable polymorphism related attribute for types themselves because of following reason:
Do you have any opinion for above? It is hard to implement in 0.7.0 soon, but it can be implemented in 0.8 release.
isaacabraham commentedon Aug 30, 2016
Hi :-) My opinion is that we would still need this in order to use MsgPack so if this could be added it would be great.
Attributes at the type level would be acceptable for those types in the hierarchy, but not for every property that used one of those types.
yfakariya commentedon Sep 5, 2016
Thank you for your opinion. Do you say that attribute qualification is messy?
BTW, As plus one of type level attribute qualification, I've exposed polymorphic APIs to public. You can use it to control polymorphism on the fly:
It is still complex and advanced feature, but I think it can solve your problem (2).
yfakariya commentedon May 4, 2017
Close because it was answered over half year ago.