Xamarin: How .NET MAUI will change the life of Xamarin.Forms development

.NET 6 and .NET MAUI is on the sill, but how will it affect the development of Xamarin applications?

For today, I have brought you a video by James Montemagno, a Xamarin developer working at Microsoft.

Follow James on the following platforms:

🌱 https://montemagno.com
🎙 https://mergeconflict.fm, https://blunders.fm, https://nintendodispatch.com
🦜 https://twitter.com/jamesmontemagno
🎥 https://youtube.com/jamesmontemagno

Xamarin.Android : Google Play app target level error solution

If you are uploading an application to the Google Play, and it gives the following error:

Your app currently targets API level 28 and must target at least API  level 29 to ensure it is built on the latest APIs optimized for security  and performance. Change your app's target API level to at least 29 

You have to change the target framework and the target android version in your androidmanifest.xml or in the UI editor of the manifest. To change it, set the Target Framework in the properties tab of your android application

Changing target framework

Then Navigate to Android Manifest option, and set target android version

Setting Target Android version

If you are re archive your application, it will upload successfully.

.NET JSON Serialization and deserialization flavoured with some inheritance

Imagine, you have a base class.

    public class BaseClass
    {
        public string BaseProperty { get; set; }
    }

It can have a base property in it. To keep OOP principles in mind, you are creating a derived class by of it called “InheritedClass”

    public class InheritedClass : BaseClass
    {
        public string PlusProperty { get; set; }
    }

And you are defining a container class, which holds an instance of a BaseClass or an InheritedClass. You are defining a property with BaseClass type. It will fit to InheritedClass too.

    public class ContainerClass
    {
        public BaseClass Property { get; set; }
    }

If you are casting your object, the PlusProperty’s value never gets lost, because the framework allocates the memory for an InheritedClass.

But what about, if you are serialize this object, and then deserialize it back? What do you think, what will be the result of this program?

    class Program
    {
        static void Main(string[] args)
        {
            var toBeSerialized = new ContainerClass();
            toBeSerialized.Property = new InheritedClass()
            {
                BaseProperty = "I am base property",
                PlusProperty = "I am an inherited plus property"
            };

            string serializedJSON = JsonConvert.SerializeObject(toBeSerialized);

            ContainerClass deserialized = (ContainerClass)JsonConvert.DeserializeObject(serializedJSON, typeof(ContainerClass));

            Console.WriteLine(deserialized.Property.GetType().AssemblyQualifiedName);
            Console.WriteLine((deserialized.Property as InheritedClass)?.PlusProperty);
            Console.ReadLine();
        }
    }

This code snippet gives the following result:

TestConsoleApp.BaseClass, TestConsoleApp, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null


That is because JSON does not include type names when serializing and deserializing an object.

You can set TypeNameHandling = All for your JsonSerializerSettings, but it is highly unrecommended by Microsoft, because it can lead you into security issues, allows attackers remote code execution.

        static void Main(string[] args)
        {
            var toBeSerialized = new ContainerClass();
            toBeSerialized.Property = new InheritedClass()
            {
                BaseProperty = "I am base property",
                PlusProperty = "I am an inherited plus property"
            };

            string serializedJSON = JsonConvert.SerializeObject(toBeSerialized, new JsonSerializerSettings()
            {
                TypeNameHandling = TypeNameHandling.All
            });

            ContainerClass deserialized = (ContainerClass)JsonConvert.DeserializeObject(serializedJSON, typeof(ContainerClass), new JsonSerializerSettings()
            {
                TypeNameHandling = TypeNameHandling.All
            });

            Console.WriteLine(deserialized.Property.GetType().AssemblyQualifiedName);
            Console.WriteLine((deserialized.Property as InheritedClass)?.PlusProperty);
            Console.ReadLine();
        }

Output:

TestConsoleApp.InheritedClass, TestConsoleApp, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
I am an inherited plus property

” Insecure deserializers are vulnerable when deserializing untrusted data. An attacker could modify the serialized data to include unexpected types to inject objects with malicious side effects. An attack against an insecure deserializer could, for example, execute commands on the underlying operating system, communicate over the network, or delete files. ” More details at: https://docs.microsoft.com/en-us/dotnet/fundamentals/code-analysis/quality-rules/ca2326

.NET Core: Type serialization denied

When trying to return with a complex object in .NET Core API, which has a Type property in it, the serializer gives the following exception :

System.NotSupportedException: Serialization and deserialization of 'System.Type' instances are not supported and should be avoided since they can lead to security issues.

Passing Type, DataSet, DataTable through the JSON or XML serializer gives possibility to remote code execution for attackers. More information available at https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/dataset-datatable-dataview/security-guidance

Workaround:
Declare an enumeration for your types (ex: enum { string, int, etc }) you can parse the value for the requested type explicitly.