I'm coding a sort or RPC system: when the user calls a method, a proxy catches the parameters, seri...

# serialization

[Gilles Barbier]

I'm coding a sort or RPC system: when the user calls a method, a proxy catches the parameters, serialize them, send them elsewhere where those parameters should be deserialized to call an actual implementation of the initial method: the issue is that I do not see any way to get the serializers needed for deserializing the parameters correctly. For each parameter, I can transport the class name also, but it's not enough to get the needed serializer. Any hints?

[Big Chungus]

There's a helper function in the lib already that does this serializer lookup by name via reflection (discussed in the post above yours). Have a look at how it's implemented to see if you can do something similar for your use case

[Big Chungus]

https://github.com/Kotlin/kotlinx.serialization/blob/5ce8e2cbd8d324ed5e0447f133137ccacc9f6614/core/commonMain/src/kotlinx/serialization/SerialFormat.kt#L88

[rnett]

I did something similar using compiler plugins (krosstalk), it's rather difficult if you don't have the method signature available at both ends

[rnett]

And even if you do, I don't see a way to do it without either heavy reflection (you can get the KType from reflection afaik, and the serializer from that with serializer(KType)) or a compiler plugin

[Gilles Barbier]

The method signature is not that important (e.g. it could use interfaces). But I can catch the parameters instances, get their KType. But I have no idea how I can send it with the serialized data, the reinstantiate it. Basically, how to serialize KType?

[CLOVIS]

Also, that's dangerous: any attacker can create a message to tell the server to deserialize and instantiate any class.

[CLOVIS]

That's why you always have to specify the type you expect when deserializing.

[Gilles Barbier]

@CLOVIS that's a fair point. Nevertheless, in my case, the user controls both ends.

[pdvrieze]

What you are wanting to do is effectively using polymorphic serialization. Or something like it where you use your own implementation. This implementation of your own would write the serial type and then use contextual serialization to look up the type. Perhaps more robust is to actually use the method signatures to determine the types needed. If your RPC system is static, you could do this statically, otherwise you're going to be limited to reflection based type/serializer lookup (which still depends on the SerializersModule for security reasons). Btw. "the user controls both ends" is never a valid excuse to break security, only to focus the measures you use.