do not use TypeNameHandling.Auto when deserializing (#15390)

.editorconfig

@@ -10,6 +10,11 @@ end_of_line = lf
 charset = utf-8
 trim_trailing_whitespace = true
 insert_final_newline = true
+dotnet_diagnostic.CA2327.severity = error
+dotnet_diagnostic.CA2329.severity = error
+dotnet_diagnostic.CA2330.severity = error
+dotnet_diagnostic.CA2328.severity = error
+dotnet_diagnostic.CA2326.severity = warning
 
 [*.tt]
 insert_final_newline = false

src/DynamoCore/DynamoCore.csproj

@@ -181,4 +181,8 @@
         <GenerateResource SdkToolsPath="$(TargetFrameworkSDKToolsDirectory)" UseSourcePath="true" Sources="$(ProjectDir)/BuiltInAndOperators/BuiltInImages.resx" OutputResources="$(ProjectDir)/BuiltInAndOperators/BuiltInImages.resources" />
         <AL SdkToolsPath="$(TargetFrameworkSDKToolsDirectory)" TargetType="library" EmbedResources="$(ProjectDir)/BuiltInAndOperators/BuiltInImages.resources" OutputAssembly="$(OutDir)BuiltIn.customization.dll" Version="%(AssemblyInfo.Version)" />
     </Target>
+    <PropertyGroup>
+        <EnableNETAnalyzers>true</EnableNETAnalyzers>
+		<AnalysisModeSecurity>All</AnalysisModeSecurity>
+    </PropertyGroup>
 </Project>

src/DynamoCore/Graph/Nodes/DummyNode.cs

@@ -1,4 +1,4 @@
-using Autodesk.DesignScript.Runtime;
+using Autodesk.DesignScript.Runtime;
 using Dynamo.Core;
 using Dynamo.Engine;
 using Dynamo.Graph.Nodes.NodeLoaders;
@@ -546,7 +546,7 @@ internal NodeModel GetNodeModelForDummyNode(string json, LibraryServices library
                     Console.WriteLine(args.ErrorContext.Error);
                 },
                 ReferenceLoopHandling = ReferenceLoopHandling.Ignore,
-                TypeNameHandling = TypeNameHandling.Auto,
+                TypeNameHandling = TypeNameHandling.None,
                 Formatting = Newtonsoft.Json.Formatting.Indented,
                 Culture = CultureInfo.InvariantCulture,
                 Converters = new List<JsonConverter>{

src/DynamoCore/Graph/Workspaces/WorkspaceModel.cs

@@ -70,7 +70,7 @@ static internal ExtraWorkspaceViewInfo ExtraWorkspaceViewInfoFromJson(string jso
                     Console.WriteLine(args.ErrorContext.Error);
                 },
                 ReferenceLoopHandling = ReferenceLoopHandling.Ignore,
-                TypeNameHandling = TypeNameHandling.Auto,
+                TypeNameHandling = TypeNameHandling.None,
                 Formatting = Newtonsoft.Json.Formatting.Indented,
                 Culture = CultureInfo.InvariantCulture
             };
@@ -2289,7 +2289,7 @@ public static WorkspaceModel FromJson(string json, LibraryServices libraryServic
                     Console.WriteLine(args.ErrorContext.Error);
                 },
                 ReferenceLoopHandling = ReferenceLoopHandling.Ignore,
-                TypeNameHandling = TypeNameHandling.Auto,
+                TypeNameHandling = TypeNameHandling.None,
                 Formatting = Newtonsoft.Json.Formatting.Indented,
                 Culture = CultureInfo.InvariantCulture,
                 Converters = new List<JsonConverter>{
@@ -2326,7 +2326,7 @@ public static WorkspaceModel FromJson(string json, LibraryServices libraryServic
                     Console.WriteLine(args.ErrorContext.Error);
                 },
                 ReferenceLoopHandling = ReferenceLoopHandling.Ignore,
-                TypeNameHandling = TypeNameHandling.Auto,
+                TypeNameHandling = TypeNameHandling.None,
                 Formatting = Newtonsoft.Json.Formatting.Indented,
                 Culture = CultureInfo.InvariantCulture,
                 Converters = new List<JsonConverter>{

src/DynamoCore/Models/DynamoModel.cs

@@ -2118,7 +2118,7 @@ static private DynamoPreferencesData DynamoPreferencesDataFromJson(string json)
                     Console.WriteLine(args.ErrorContext.Error);
                 },
                 ReferenceLoopHandling = ReferenceLoopHandling.Ignore,
-                TypeNameHandling = TypeNameHandling.Auto,
+                TypeNameHandling = TypeNameHandling.None,
                 Formatting = Newtonsoft.Json.Formatting.Indented,
                 Culture = CultureInfo.InvariantCulture
             };

src/DynamoCore/Models/RecordableCommands.cs

@@ -31,24 +31,6 @@ public abstract class RecordableCommand
             // See property for more details.
             protected bool redundant = false;
 
-            /// <summary>
-            /// Settings that is used for serializing commands
-            /// </summary>
-            protected static JsonSerializerSettings jsonSettings;
-
-            /// <summary>
-            /// Initialize commands serializing settings
-            /// </summary>
-            static RecordableCommand()
-            {
-                jsonSettings = new JsonSerializerSettings()
-                {
-                    TypeNameHandling = TypeNameHandling.Objects,
-                    ContractResolver = new CamelCasePropertyNamesContractResolver(),
-                    Culture = CultureInfo.InvariantCulture
-                };
-            }
-
             #endregion
 
             #region Public Class Operational Methods
@@ -109,18 +91,6 @@ internal XmlElement Serialize(XmlDocument document)
                 return element;
             }
 
-            /// <summary>
-            /// This method serializes the RecordableCommand object in the json form.
-            /// The resulting string contains command type name and all the
-            /// arguments that are required by this command.
-            /// </summary>
-            /// <returns>The string can be used for reconstructing RecordableCommand
-            /// using Deserialize method</returns>
-            internal string Serialize()
-            {
-                return JsonConvert.SerializeObject(this, jsonSettings);
-            }
-
             /// <summary>
             /// Call this static method to reconstruct a RecordableCommand-derived
             /// object given an XmlElement that was previously saved with Serialize
@@ -220,29 +190,6 @@ internal static RecordableCommand Deserialize(XmlElement element)
                 throw new ArgumentException(message);
             }
 
-            /// <summary>
-            /// Call this static method to reconstruct a RecordableCommand from json
-            /// string that contains command name - name of corresponding class inherited
-            /// from RecordableCommand, - and all the arguments that are required by this
-            /// command.
-            /// </summary>
-            /// <param name="jsonString">Json string that contains command name and all
-            /// its arguments.</param>
-            /// <returns>Reconstructed RecordableCommand</returns>
-            internal static RecordableCommand Deserialize(string jsonString)
-            {
-                RecordableCommand command = null;
-                try
-                {
-                    command = JsonConvert.DeserializeObject(jsonString, jsonSettings) as RecordableCommand;
-                    command.IsInPlaybackMode = true;
-                    return command;
-                }
-                catch
-                {
-                    throw new ApplicationException("Invalid jsonString for creating RecordableCommand");
-                }
-            }
             #endregion
 
             #region Public Command Properties

src/DynamoCore/PublicAPI.Unshipped.txt

@@ -2723,7 +2723,6 @@ static Dynamo.Models.DynamoModel.IsTestMode.set -> void
 static Dynamo.Models.DynamoModel.ModelBasedRecordableCommand.DeserializeGuid(System.Xml.XmlElement element, Dynamo.Utilities.XmlElementHelper helper) -> System.Collections.Generic.IEnumerable<System.Guid>
 static Dynamo.Models.DynamoModel.OnRequestDispatcherBeginInvoke(System.Action action) -> void
 static Dynamo.Models.DynamoModel.OnRequestDispatcherInvoke(System.Action action) -> void
-static Dynamo.Models.DynamoModel.RecordableCommand.jsonSettings -> Newtonsoft.Json.JsonSerializerSettings
 static Dynamo.Models.DynamoModel.RequestDispatcherBeginInvoke -> Dynamo.Models.ActionHandler
 static Dynamo.Models.DynamoModel.RequestDispatcherInvoke -> Dynamo.Models.ActionHandler
 static Dynamo.Models.DynamoModel.SetUICulture(string locale) -> void

src/DynamoCoreWpf/ViewModels/Watch3D/HelixWatch3DViewModel.cs

@@ -794,7 +794,7 @@ protected override void OnWorkspaceOpening(object obj)
                         Console.WriteLine(args.ErrorContext.Error);
                     },
                     ReferenceLoopHandling = ReferenceLoopHandling.Ignore,
-                    TypeNameHandling = TypeNameHandling.Auto,
+                    TypeNameHandling = TypeNameHandling.None,
                     Formatting = Newtonsoft.Json.Formatting.Indented,
                     Culture = CultureInfo.InvariantCulture
                 };

test/DynamoCoreTests/Models/RecordableCommandsTest.cs

@@ -1,4 +1,4 @@
-using System;
+using System;
 using System.Collections.Generic;
 using System.Linq;
 using System.Xml;
@@ -53,12 +53,12 @@ public void TestRecordableCommand()
             //The tag passed as parameter is null, then it will raise an exception later
             var cmd = new Mock<DynamoModel.RecordableCommand>(null);
             var pausePlaybackCommand = new DynamoModel.PausePlaybackCommand(20);
-
+            var xmldoc= new XmlDocument();
             //Act
-            var xmlElements = pausePlaybackCommand.Serialize();
-    
+            var xmlElements = pausePlaybackCommand.Serialize(xmldoc);
+
             //Assert
-            Assert.IsNotNull(JToken.Parse(xmlElements));//Verify that the json serialized is valid
+            Assert.IsNotNull(xmlElements);
 
             //This will execute the exception section in RecordableCommand(string tag), because tag is null
             Assert.Throws<System.Reflection.TargetInvocationException>(() => executive.ExecuteCommand(cmd.Object, "TestRecordable", "ExtensionTests"));
@@ -92,8 +92,7 @@ public void TestRecordableCommandDeserialize()
             XmlDocument xmlDocument = new XmlDocument();
             XmlElement elementAddPresetCommand = AddPresetCommand.Serialize(xmlDocument);
 
-            var jsonAddPresetCommand = AddPresetCommand.Serialize();
-
+            var xmlAddPresetCommand = AddPresetCommand.Serialize(xmlDocument);
 
             var helper = new XmlElementHelper(elementAddPresetCommand);
             Guid gWorkspace = Guid.NewGuid();
@@ -109,12 +108,6 @@ public void TestRecordableCommandDeserialize()
             var deserializedAddPresetCommand = DynamoModel.RecordableCommand.Deserialize(elementAddPresetCommand);
             var deserializedApplyPresetCommand = DynamoModel.RecordableCommand.Deserialize(elementApplyPresetCommand);
 
-            //This will execute the overloaded Deserialize method (the one receiving a string as parameter)
-            var deserializedFromJson = DynamoModel.RecordableCommand.Deserialize(jsonAddPresetCommand);
-
-            //This will generate a invalid json string, so when it's deserialized will raise an exception
-            jsonAddPresetCommand = jsonAddPresetCommand.Replace('{', '<');
-
             //This is a fake command so when it's deserialized will raise an exception
             XmlElement elemTest = xmlDocument.CreateElement("TestCommand");
             Assert.Throws<ArgumentException>(() => DynamoModel.RecordableCommand.Deserialize(elemTest));
@@ -123,9 +116,6 @@ public void TestRecordableCommandDeserialize()
             //This will check that the Deserialized commands are valid
             Assert.IsNotNull(deserializedAddPresetCommand);
             Assert.IsNotNull(deserializedApplyPresetCommand);
-            Assert.IsNotNull(deserializedFromJson);
-            Assert.Throws<ApplicationException>(() => DynamoModel.RecordableCommand.Deserialize(jsonAddPresetCommand));
-
 
         }
     }