Remove BinaryFormatter usage from ResourceReader

[GrabYourPitchforks]

Ref:

runtime/src/libraries/System.Private.CoreLib/src/System/Resources/ResourceReader.Core.cs

Lines 67 to 85 in af828ae

	private void InitializeBinaryFormatter()
	{
	LazyInitializer.EnsureInitialized(ref s_binaryFormatterType, () =>
	Type.GetType("System.Runtime.Serialization.Formatters.Binary.BinaryFormatter, System.Runtime.Serialization.Formatters, Version=0.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",
	throwOnError: true)!);
	LazyInitializer.EnsureInitialized(ref s_deserializeMethod, () =>
	{
	MethodInfo binaryFormatterDeserialize = s_binaryFormatterType!.GetMethod("Deserialize", new Type[] { typeof(Stream) })!;
	// create an unbound delegate that can accept a BinaryFormatter instance as object
	return (Func<object?, Stream, object>)typeof(ResourceReader)
	.GetMethod(nameof(CreateUntypedDelegate), BindingFlags.NonPublic | BindingFlags.Static)!
	.MakeGenericMethod(s_binaryFormatterType)
	.Invoke(null, new object[] { binaryFormatterDeserialize })!;
	});
	_binaryFormatter = Activator.CreateInstance(s_binaryFormatterType!)!;
	}

This issue tracks the removal and replacement of this code per the BinaryFormatter obsoletion plan.

[ghost]

Tagging subscribers to this area: @tarekgh, @buyaa-n, @krwq
Notify danmosemsft if you want to be subscribed.

[pgovind]

Alright, so I spent some time looking at the BinaryFormatter usage here. It is very simple to hide the BinaryFormatter usage in ResourceReader.Core.cs behind an AppContextSwitch, however, I think this is premature at this point. First, some context: Our own tools (ResGen, WinForms) create resx files at the moment that may contain binary formatted data. Assuming we have a serialized resx file, there are 2 ways to deserialize at the moment: Using ResourceReader from S.P.CoreLib or using ResourceReader from S.Resources.Extensions (SRE). BF usage in SRE is tracked by #39292. So, this means that currently both these code paths are being used to deserialize their resx files. So, our options here seem to be:

1. Follow the deprecation steps outlined by @ericstj in Remove BinaryFormatter usage from System.Resources.Extensions #39292. This would mean this issue will remain blocked until Remove BinaryFormatter usage from System.Resources.Extensions #39292 is fixed.
2. Deprecate BF usage in S.P.CoreLib's ResourceReader alone by hiding it behind an AppContext switch. This will likely "break" anyone not using SRE currently (possibly everyone generating resx files in NET Framework and reading them in .NET Core) but these folks can always turn the AppContext switch on to preserve current behavior. If we decide to go down this road, we need to determine when we want to do the deprecation. We can do it right now for Preview 4 or we can do it in P1 of the next release.

Curious to hear more opinions here.

cc @GrabYourPitchforks @ericstj @jeffhandley @jkotas

[jkotas]

It is very simple to hide the BinaryFormatter usage in ResourceReader.Core.cs behind an AppContextSwitch

The binary formatter usage is behind System.Resources.ResourceManager.AllowCustomResourceTypes switch in this file already.

This would mean this issue will remain blocked until #39292 is fixed.

Right, the real for this issue is WinForms (#39292 (comment)). I think it should be fine to resolve this issue as as dup of #39292.

[danmoseley]

dupe of #39292