How to include derived class properties in the output JSON?

[Nefcanto]

I have a base class called Filter. Many derived classes inherit from it including:

1. MultiChoiceFilter
2. BooleanFilter
3. RangeFilter
4. LocationFilter
5. ColorFilter
6. ...

I have a general action that searches the entire code, finds GetFilters methods, calls them, combines the results into a list, and returns it:

[HttpGet]
public List<Filter> GetFilters()
{
    var filterProviders = FindFilterProviders();
    var filters = new List<Filter>();
    foreach (var filterProvider in filterProviders)
   {
       var providerFilters = ((IFilterProvider)filterProvider).GetFilters();
       filters.AddRange(providerFilters);
   }
    return filters;
}

The point is that each GetFilter might return different types of filters. And when I see the filters before it returns to the client, I can see that each derived class has its own properties.
For example the RangeFilter has the Min and Max property.

Yet when I see the output JSON in the browser, I only see properties of the Filter class.

How can I solve this?

[huoyaoyuan]

System.Text.Json by default work with the static type in signature (base type), not the dynamic type of the object (derived type) unless the static type is object.

You need to enable Polymorphic serialization to get such dynamic behavior. The extra discriminator isn't required when deserialization is not used.

[Nefcanto]

@huoyaoyuan, solved like a charm. But can't we just configure a simple boolean flag? Compare these codes:

 useMostDerivedTypes = true

with

[JsonDerivedType(typeof(MultiChoiceFilter))]
[JsonDerivedType(typeof(BooleanFilter))]
[JsonDerivedType(typeof(RangeFilter))]
[JsonDerivedType(typeof(ColorFilter))]
[JsonDerivedType(typeof(FailedFilter))]
public class Filter

The second code is not only more, but also not extensible. What if I want to distribute a library? What if a developer wants to create another type of SomeCustomerFilter?

[eiriktsarpalis]

On the other hand, unchecked polymorphic serialization can result in accidental information disclosure. For example:

public class Filter { /* ... */ }

// Derived class in some other project
public class MyFilterFactory : IFilterFactory
{
    public Filter Create() => new MyFilter { MyApiKey = /* your user secret goes here */ };
    private class MyFilter : Filter
    {
        public string MyApiKey { get; set; } // Some property used by the implementation only.
    }
}

In unchecked polymorphic serialization, if you attempt to deserialize the output from MyFilterFactory then the API key would be leaked to the JSON payload.

[huoyaoyuan]

On the other hand, unchecked polymorphic serialization can result in accidental information disclosure.

I also considered this case. But polymorphic serialization is quite convenient, and effectively being the default of dynamic languages. Can we have a convenient flag/attribute to opt-in it? It's also somehow achievable with the object static type.

[Nefcanto]

@eiriktsarpalis, valid argument. Thank you. Yet we should have the option to explicitly and conveniently choose polymorphic serialization. And with great power comes great responsibility. A warning somehow can once notify the developer about the risks. Yet whoever chose it, has chosen the risks too. I would choose it because in my filtering hierarchy, it's totally OK.

[eiriktsarpalis]

Can we have a convenient flag/attribute to opt-in it? It's also somehow achievable with the object static type.

It was proposed but rejected by the security team. The behavior of object is something that slipped through that we can't undo at this point.

[eiriktsarpalis]

And with great power comes great responsibility. A warning somehow can once notify the developer about the risks. Yet whoever chose it, has chosen the risks too. I would choose it because in my filtering hierarchy, it's totally OK.

It's something that will not ship as an out of the box option. If you are willing to take the risk, then writing your own converter that does it is the only way forward.

[Nefcanto]

@huoyaoyuan, thank you so much for your help. This was one of the best help I ever received. Fast, correct, and informative. Wish you good luck.