Wp7 serialization security exception

0
votes

First of all, the description may be a little long with lots of code, but I wan't to provide with all the information I can. I'm working with tombstoning for my app, and I would like to save a serialized class:

    [DataContract]
    private class Tombstone
    {
        [DataMember]
        public UserDetails UserProfile { get; set; }
    }


    // Create instance of the tombstone class
    private Tombstone _tombstone;
    public ProfileSetup()
    {
        _tombstone = new Tombstone();
    }


    //Add data to userProfile
    void UserInformationAccess_OnGetUserDetailsComplete(GetUserDetailsResponse response)
    {
        _tombstone.UserProfile = response.userDetails;
    }

And I have the exception in the on navigated from... exactly here:

    protected override void OnNavigatedFrom(NavigationEventArgs e)
    {
        if (_tombstone != null)
            this.SaveState("tombstone", _tombstone);
    }

//The state manager class
public static class StateManager
{
    /// <summary>
    /// Saves a key-value pair into the state object
    /// </summary>
    /// <param name="phoneApplicationPage">The phone application page.</param>
    /// <param name="key">The key.</param>
    /// <param name="value">The value.</param>
    public static void SaveState(this PhoneApplicationPage phoneApplicationPage, string key, object value)
    {
        if (phoneApplicationPage.State.ContainsKey(key))
        {
            phoneApplicationPage.State.Remove(key);
        }

        phoneApplicationPage.State.Add(key, value);
    }
}

And now brace yourselves the exception is comming:

"SecurityException"

   at System.Runtime.Serialization.DataContract.DataContractCriticalHelper.CreateDataContract(Int32 id, RuntimeTypeHandle typeHandle, Type type)
   at System.Runtime.Serialization.DataContract.DataContractCriticalHelper.GetDataContractSkipValidation(Int32 id, RuntimeTypeHandle typeHandle, Type type)
   at System.Runtime.Serialization.DataContract.GetDataContractSkipValidation(Int32 id, RuntimeTypeHandle typeHandle, Type type)
   at System.Runtime.Serialization.DataContract.GetDataContract(RuntimeTypeHandle typeHandle, Type type, SerializationMode mode)
   at System.Runtime.Serialization.XmlObjectSerializerContext.GetDataContract(RuntimeTypeHandle typeHandle, Type type)
   at System.Runtime.Serialization.XmlObjectSerializerWriteContext.SerializeWithXsiType(XmlWriterDelegator xmlWriter, Object obj, RuntimeTypeHandle objectTypeHandle, Type objectType, Int32 declaredTypeID, RuntimeTypeHandle declaredTypeHandle, Type declaredType)
   at System.Runtime.Serialization.XmlObjectSerializerWriteContext.InternalSerialize(XmlWriterDelegator xmlWriter, Object obj, Boolean isDeclaredType, Boolean writeXsiType, Int32 declaredTypeID, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.XmlObjectSerializerWriteContext.InternalSerializeReference(XmlWriterDelegator xmlWriter, Object obj, Boolean isDeclaredType, Boolean writeXsiType, Int32 declaredTypeID, RuntimeTypeHandle declaredTypeHandle)
   at System.Reflection.RuntimeMethodInfo.InternalInvoke(RuntimeMethodInfo rtmi, Object obj, BindingFlags invokeAttr, Binder binder, Object parameters, CultureInfo culture, Boolean isBinderDefault, Assembly caller, Boolean verifyAccess, StackCrawlMark& stackMark)
   at System.Reflection.RuntimeMethodInfo.InternalInvoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture, StackCrawlMark& stackMark)
   at System.Reflection.MethodBase.Invoke(Object obj, Object[] parameters)
   at System.Runtime.Serialization.XmlFormatWriter.InternalSerialize(MethodInfo methodInfo, Object memberValue, Type memberType, Boolean writeXsiType, XmlObjectSerializerWriteContext context, XmlWriterDelegator xmlWriter)
   at System.Runtime.Serialization.XmlFormatWriter.WriteValue(Type memberType, Object memberValue, Boolean writeXsiType, XmlObjectSerializerWriteContext context, XmlWriterDelegator xmlWriter)
   at System.Runtime.Serialization.XmlFormatWriter.WriteMember(SerializingObject serObj, Int32 memberIndex, ClassDataContract derivedMostClassContract)
   at System.Runtime.Serialization.XmlFormatWriter.WriteClass(CallStackElement`1 callStackElement)
   at System.Runtime.Serialization.XmlFormatWriter.Serialize(XmlObjectSerializerWriteContext context)
   at System.Runtime.Serialization.XmlFormatWriter.InitializeCallStack(XmlWriterDelegator xmlWriterDel, Object obj, XmlObjectSerializerWriteContext writeContext, DataContract contract)
   at System.Runtime.Serialization.CollectionDataContract.WriteXmlValue(XmlWriterDelegator xmlWriter, Object obj, XmlObjectSerializerWriteContext context)
   at System.Runtime.Serialization.XmlObjectSerializerWriteContext.WriteDataContractValue(DataContract dataContract, XmlWriterDelegator xmlWriter, Object obj, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.XmlObjectSerializerWriteContext.SerializeWithoutXsiType(DataContract dataContract, XmlWriterDelegator xmlWriter, Object obj, RuntimeTypeHandle declaredTypeHandle)
   at System.Runtime.Serialization.DataContractSerializer.InternalWriteObjectContent(XmlWriterDelegator writer, Object graph)
   at System.Runtime.Serialization.DataContractSerializer.InternalWriteObject(XmlWriterDelegator writer, Object graph)
   at System.Runtime.Serialization.XmlObjectSerializer.WriteObjectHandleExceptions(XmlWriterDelegator writer, Object graph)
   at System.Runtime.Serialization.XmlObjectSerializer.WriteObject(XmlDictionaryWriter writer, Object graph)
   at System.Runtime.Serialization.XmlObjectSerializer.WriteObject(Stream stream, Object graph)
   at Microsoft.Phone.Shell.StreamPersister.Serialize(IDictionary`2 dictionary, IEnumerable`1 knownTypes)
   at Microsoft.Phone.Shell.StreamPersister.Save(ShellPage shellPage, String key, IDictionary`2 dictionary, IEnumerable`1 knownTypes)
   at Microsoft.Phone.Controls.PhoneApplicationPage.InternalOnNavigatedFrom(NavigationEventArgs e)
   at System.Windows.Navigation.NavigationService.RaiseNavigated(Object content, Uri uri, NavigationMode mode, Boolean isNavigationInitiator, PhoneApplicationPage existingContentPage, PhoneApplicationPage newContentPage)
   at System.Windows.Navigation.NavigationService.Journal_NavigatedExternally(Object sender, JournalEventArgs args)
   at System.Windows.Navigation.Journal.OnNavigatedExternally(String name, Uri uri, NavigationMode mode)
   at System.Windows.Navigation.Journal.ShellPage_NavigatedAway(Object sender, NavigateAwayEventArgs args)
   at Microsoft.Phone.Shell.Interop.ShellPageCallback.FireOnNavigateAway(IntPtr thisPage, Direction direction, IntPtr pageNext)

I have researched alot related to this, and I cam out empty :( any help is appreciated.

[EDITS]

Seams like the problem was that the TombStone class has private accessibility, I changed that... but than I got the following exception:

Type 'Newtonsoft.Json.Linq.JObject' with data contract name 'ArrayOfKeyValueOfstringJTokeneJCYCtcq:http://schemas.microsoft.com/2003/10/Serialization/Arrays' is not expected. Add any types not known statically to the list of known types - for example, by using the KnownTypeAttribute attribute or by adding them to the list of known types passed to DataContractSerializer.

also here is the UserDetails class

[KnownType(typeof(Phone[]))]
[KnownType(typeof(UserInterest<InterestCategory?, object>))]
[KnownType(typeof(UserInterest<InterestCategory?, object>[]))] 


    [DataContract]
    public class UserDetails
    {
        /// <summary>
        /// Specifies an identifier of user
        /// </summary>
        /// 
        [DataMember]
        public long userId { get; set; }

        /// <summary>
        /// Specifies a nick of user
        /// </summary>
        /// 
        [DataMember]
        public string nick { get; set; }

        /// <summary>
        /// Specifies a full name of user. The field is absent if it has null value
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]

        [DataMember]
        public string fullName { get; set; }

        /// <summary>
        /// Specifies a gender of user. The field is absent if it has null value
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [JsonConverter(typeof(EnumAttributeConverter<Gender>))]
        [DataMember]
        public Gender? gender { get; set; }

        /// <summary>
        /// Specifies a birthday of user as string in dd.MM.yyyy format.
        /// The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public string birthday { get; set; }

        /// <summary>
        /// Specifies an e-mail of user. The field is absent if it has null value
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public string email { get; set; }

        /// <summary>
        /// Specifies a website of user. The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public string website { get; set; }

        /// <summary>
        /// Specifies a general information about user. The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public string about { get; set; }

        /// <summary>
        /// Specifies a place of birth for user. The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public Address<Country?>? homeAddress { get; set; }

        /// <summary>
        /// Specifies a place of residence for user. The field is absent if it has null value. 
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public Address<Country?>? currentAddress { get; set; }

        /// <summary>
        /// Specifies a list of user's phones. The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]       
        public Phone[] phones { get; set; }

        /// <summary>
        /// Specifies an URI of avatar of profile. The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public string avatar { get; set; }

        /// <summary>
        /// Specifies a job. The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public string job { get; set; }

        /// <summary>
        /// Specifies a mood status of user as a color.The field is absent in read commands if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public int? mood { get; set; }

        /// <summary>
        /// Specifies a relationship status of user.The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public RelationshipStatus? relationshipStatus { get; set; }

        /// <summary>
        /// Defines a discovery purpose specified by user.The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public DiscoveryPurpose? discoveryPurpose { get; set; }

        /// <summary>
        /// Specifies a list of user interests. The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public UserInterest<InterestCategory?, object>[] interests { get; set; }

        /// <summary>
        /// Specifies a status of user. The field is absent if it has null value.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public string status { get; set; }

        /// <summary>
        /// Specifies an availability status of user.
        /// </summary>
        [JsonConverter(typeof(EnumAttributeConverter<AvailabilityStatus>))]
        [DataMember]
        public AvailabilityStatus availabilityStatus { get; set; }

        /// <summary>
        /// Specifies a location of user. The field is absent if location is undefined.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public Location location { get; set; }

        /// <summary>
        /// Defines if the given user and the requestor interacted previously.
        /// </summary>
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        [DataMember]
        public bool interacted { get; set; }

        /// <summary>
        /// Defines the status of pending friendship request if it exists.
        /// Equals NONE if there is no pending friendship request.
        /// Equals PENDING_IN if the given user sent friendship
        /// request to the user (requestor) who requests extended
        /// information.
        /// Equals PENDING_OUT if the requestor sent friendship
        /// request to the given request.
        /// </summary>
        [JsonConverter(typeof(EnumAttributeConverter<FriendshipRequestStatus>))]
        [DataMember]
        public FriendshipRequestStatus friendshipRequestStatus { get; set; }

        /// <summary>
        /// Defines if the given user was ignored by the requestor.
        /// </summary>
        /// 
        [DataMember]
        public bool ignored { get; set; }
    }
2
windows-phone-7serializationsecurityexceptiontombstoning
Can you also show your page's SaveState? – Robaticus
ehm, it is there, you wan't to say LoadState? – Igor Meszaros
Sorry-- I didn't notice that it was an extension method. I have most definitely not had enough coffee yet this morning. :) – Robaticus
Can you post the definition of UserDetails? – carlosfigueira
The main reason for asking to see UserDetails was so that we could verify it's ability to be serialized. As it contains a number of your own other custom classes there is no easy way for us to do this. One of the best ways to get help with a question is to provide a simple way for would-be answerers to reproduce the issue. – Matt Lacey

2 Answers

2
votes

The exception indicates that one of the Types referenced is not accessible / visible in the context of the serializer... The problem is that you defined your class as private:

"private class Tombstone"

This means that it is only visible to the class in which it is defined.
You need to make this class public.

1
votes

The problem is with the ability of the DataContractSerializer to serialize your UserDetails object.

The Add method of the page's State dictionary will serialize objects with the `DataContractSerializer.

You have shown that you have marked up the Tombstone class with DataContract serialization attributes but what about UserDetails?

Fortunately, you can debug this issue by attempting to serialize and deserialize the objects yourself.
You may also find that you get better performance with another serializer (json.net is good and easy to use) as the DataContractSerializer is notoriously slow.