Security Basics mailing list archives

possible bug in .xml serialization might skip messages


From: Rohit <rohits79 () yahoo com>
Date: Fri, 9 Sep 2005 04:36:52 -0700 (PDT)

Here is the snippet of the code in .net. 
With long and boolean type of variable (with variable
name declared as substring of the other) the XML
serialization doesn't work fine as expected, and
message is truncated (i.e. the required xml element is
not generated)
---

using System;
using System.Xml;
using System.IO;
using System.Xml.Serialization;

namespace ConsoleApplication1
{

      [Serializable()]
      public class tResponseGeneralInfo
      {
            public long ProfileNumber;

            public bool ProfileNumberSpecified;

      }

      class Class1
      {
            [STAThread]
            static void Main(string[] args)
            {
                  tResponseGeneralInfo obj = new
tResponseGeneralInfo();
                  obj.ProfileNumber = 23;

                  XmlDocument oXmlDoc = new
XmlDocument();
                  oXmlDoc.Load(m_Serialize(obj));
            }

            private static MemoryStream
m_Serialize(object obj)
            {
                  try
                  {
                        XmlSerializer serializer = new
XmlSerializer(obj.GetType());
                        MemoryStream ms = new
MemoryStream();
                        serializer.Serialize(ms, obj);
                        ms.Position = 0;
                        return ms;
                  }
                  catch(Exception ex)
                  {
                        throw ex;
                  }
            }
      }

}

The xml generates but without the attribute
"ProfileNumber", the funny
party is when we change the variable name
ProfileNumberSpecified to
something else it works as expected

"<?xml version=\"1.0\"?><tResponseGeneralInfo
xmlns:xsd=\"http://www.w3.org/2001/XMLSche
ma\"xmlns:xsi=\"http://www.w3.org/2001/XMLSche
ma-instance\"><ProfileNumberSp
ecified>false</ProfileNumberSpecified></tResponseGeneralInf o>

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 


Current thread: