C#


CSHARP.CLASS.SER.ENON : Nonserializable Field Element (C#)

Summary

A non-transient field of a serializable class might hold a map or collection whose elements might be non-serializable.

Serialization allows one to dump an object into a file and recover (deserialize) it later. For this to work, C# requires the class of the object to implement the System.Runtime.Serialization.ISerializable interface. Moreover, all instance non-transient fields of the class must be serializable themselves. For inner non-static classes, also the outer class must be serializable. In order to distinguish dumps of objects for distinct versions of the same class, it is required that serializable classes define a static field containing the serial version of the class.

Properties

Class Name Nonserializable Field Element (C#)
Significance reliability
Mnemonic CSHARP.CLASS.SER.ENON
Categories
CWE CWE:913 Improper Control of Dynamically-Managed Code Resources
Availability Available for C# only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Nonserializable Field Element (C#)"

Resolution

Guarantee that all instance non-transient fields of a serializable class are themselves serializable. Make inner serializable classes have a serializable outer class, or make them static.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.