C#


CSHARP.CLASS.SER.OCNON : Nonserializable Outer Class (C#)

Summary

An inner non-static serializable class has a non-serializable outer class.

Serialization allows one to dump an object into a file and recover (deserialize) it later. For this to work, C# requires the class of the object to implement the System.Runtime.Serialization.ISerializable interface. Moreover, all instance non-transient fields of the class must be serializable themselves. For inner non-static classes, also the outer class must be serializable. In order to distinguish dumps of objects for distinct versions of the same class, it is required that serializable classes define a static field containing the serial version of the class.

Properties

Class Name Nonserializable Outer Class (C#)
Significance reliability
Mnemonic CSHARP.CLASS.SER.OCNON
Categories
CWE CWE:913 Improper Control of Dynamically-Managed Code Resources
Availability Available for C# only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Nonserializable Outer Class (C#)"

Example

using System.Runtime.Serialization;
namespace DocumentationExamples
{
    public class Serialization : ISerializable
    {
        public static void Main(string[] args)
        { }

        private readonly object f;         // Nonserializable Field (C#) warning issued here 
        private readonly SerializationC.Inner inner;

        public Serialization(object f)
        {
            this.f = f;
            inner = new SerializationC.Inner();
        }
        public void GetObjectData(SerializationInfo info, StreamingContext context) { }
    }
    public class SerializationC
    {
        public class Inner : ISerializable  // Nonserializable Outer Class (C#) warning issued here 
        {
            public void GetObjectData(SerializationInfo info, StreamingContext context) { }
        }
    }
    
}

Resolution

Guarantee that all instance non-transient fields of a serializable class are themselves serializable. Make inner serializable classes have a serializable outer class, or make them static.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.