ObjectHandleSerializer - GetObjectData should be marked as SecurityCr…

…itical (#3660)
NLog · Nov 4, 2019 · 5c28ee7 · 5c28ee7
1 parent 2bd4b4c
commit 5c28ee7
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 5 deletions.
diff --git a/src/NLog/Internal/ObjectHandleSerializer.cs b/src/NLog/Internal/ObjectHandleSerializer.cs
@@ -65,10 +65,13 @@ protected ObjectHandleSerializer(SerializationInfo info, StreamingContext contex
             catch (Exception ex)
             {
                 _wrapped = string.Empty;    // Type cannot be resolved in this AppDomain
-                InternalLogger.Info(ex, "ObjectHandleSerializer failed to deserialize object: {0}", type);
+                InternalLogger.Debug(ex, "ObjectHandleSerializer failed to deserialize object: {0}", type);
             }
         }
 
+#if NET4_5
+        [System.Security.Permissions.SecurityPermissionAttribute(System.Security.Permissions.SecurityAction.LinkDemand, SerializationFormatter = true)]
+#endif
         public void GetObjectData(SerializationInfo info, StreamingContext context)
         {
             try
@@ -95,7 +98,7 @@ public void GetObjectData(SerializationInfo info, StreamingContext context)
             catch (Exception ex)
             {
                 // ToString on random object can throw exception
-                InternalLogger.Info(ex, "ObjectHandleSerializer failed to serialize object: {0}", _wrapped?.GetType());
+                InternalLogger.Debug(ex, "ObjectHandleSerializer failed to serialize object: {0}", _wrapped?.GetType());
             }
         }
 
@@ -105,4 +108,4 @@ public object Unwrap()
         }
     }
 #endif
-}
+}
diff --git a/src/NLog/MappedDiagnosticsLogicalContext.cs b/src/NLog/MappedDiagnosticsLogicalContext.cs
@@ -416,5 +416,4 @@ private static Dictionary<string, object> GetThreadLocal()
     }
 }
 
-#endif
-
+#endif
-Original file line number
+Diff line change
@@ Expand Up / @@ -416,5 +416,4 @@ private static Dictionary<string, object> GetThreadLocal() @@
         }
     }
-    #endif
+    #endif