Feature request: option to disallow deserializing union cases with private constructors

[reinux]

I do stuff like this:

type LocalPath = private LocalPath of string
with
  static member make (path: string) =
    if path.Contains ".."
    then failwith "String contains .."
    else LocalPath path
  member this.serialized =
    let (LocalPath path) = this
    path

module LocalPath =
  let (|LocalPath|) = fun (LocalPath f) -> f

This gets deserialized through reflection even though the constructor is marked private.

It would be nice to be able to disable this behavior so that it can be used viably as added security.

The current workaround is to use a custom JsonConverter and not let Fsharp.STJ unwrap anything.

[Tarmil]

Ah indeed. I would in fact consider this a bug, rather than a feature request. Private representations are not deserializable with STJ in general, so FSharp.STJ should definitely follow this behavior.

Additionally, I'm not certain what would be the best behavior for serialization. In general STJ doesn't disallow serializing objects, even ones without any public constructors, it just doesn't include their private properties. Should the serialization of a union with private representation an empty JSON object then? It definitely should be the case for records with private representation.

[reinux]

Oh, that's interesting. I wonder what it does with C# unions, if those even support private members at all?