Sharepoint 2013: Sandbox webpart error after KB5002203

Question

We have a Sharepoint 2013 farm with 2 frontends and 2 backends, running some web applications, one of them is the publishing site of the organization. On this we have some basic webparts that have been running flawlessly since 2012, on the sandbox code service. Yesterday I installed kb5002203 on one of the frontends and they started failing. I didn't notice at first so I updated also the backends. Later I noticed that only the not patched frontend is working ok. I cannot uninstall the update so I'd thank anyone that could point me on what is happening. The webparts are giving this error on logs:

[Forced due to logging gap, cached @ 05/12/2022 16:08:10.92, Original Level: Verbose]  - Sending UserCode request to this server: tcp://<the-node>:32846/SPUCExecutionHost
ExecuteRequestInSandBox call failed. System.ArgumentException: **Type was not resolvable**
 at Microsoft.SharePoint.UserCode.SPUserCodeExecutionManager.SPUserCodeSerializationBinder.BindToType(String assemblyName, String typeName)
 at System.Runtime.Serialization.Formatters.Binary.ObjectReader.Bind(String assemblyString, String typeString)
 at System.Runtime.Serialization.Formatters.Binary.ObjectReader.GetType(BinaryAssemblyInfo assemblyInfo, String name)
 at System.Runtime.Serialization.Formatters.Binary.ObjectMap..ctor(String objectName, String[] memberNames, BinaryTypeEnum[] binaryTypeEnumA, Object[] typeInformationA, Int32[] memberAssemIds, ObjectReader objectReader, Int32 objectId, BinaryAssemblyInfo assemblyInfo, SizedArray assemIdToAssemblyTable)
 at System.Runtime.Serialization.Formatters.Binary.__BinaryParser.ReadObjectWithMapTyped(BinaryObjectWithMapTyped record)
 at System.Runtime.Serialization.Formatters.Binary.__BinaryParser.Run()
 at System.Runtime.Serialization.Formatters.Binary.ObjectReader.Deserialize(HeaderHandler handler, __BinaryParser serParser, Boolean fCheck, Boolean isCrossAppDomain, IMethodCallMessage methodCallMessage)
 at System.Runtime.Serialization.Formatters.Binary.BinaryFormatter.Deserialize(Stream serializationStream, HeaderHandler handler, Boolean fCheck, Boolean isCrossAppDomain, IMethodCallMessage methodCallMessage)
 at Microsoft.SharePoint.UserCode.SPUserCodeExecutionManager.Deserialize[T](Byte[] buffer)
 at Microsoft.SharePoint.UserCode.SPUserCodeWebPartRemoteExecutionHelper.<>c__DisplayClassa.<ExecuteRequestInSandBox>b__9()
 at Microsoft.SharePoint.Utilities.SecurityContext.RunAsProcess(CodeToRunElevated secureCode)
 at Microsoft.SharePoint.UserCode.SPUserCodeWebPartRemoteExecutionHelper.ExecuteRequestInSandBox(HttpContext context, SPWeb web, SPWebPartManager manager, SPUserCodeWebPart userCodeWebPart)

I have done the typical:

• restart server
• restart sandboxed code service
• created a new page with the same webparts to check: it fails same way

As I say, on the unpatched node it is working correctly, and I don't dare to patch it now. I have disabled the access to the faulty node on our load balancer so our clients are not noticing, but I'd like to sort it out. Anyone has any clue on why is suddenly failing with this update? The backends, both patched, are working perfectly.

Thanks a lot in advance

Fran

Answer 1

If you haven't updated to KB5002219 (https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-sharepoint-foundation-2013-june-14-2022-kb5002219-bda3ac31-8e1a-4104-9dd6-a815e3454382) do that first. Documented in the KB under known issues is a way to address this.

The aforementioned update implemented a way to mark controls as safe when they are used in the Sandbox Code Solutions. You will have to make the problems occur to get the exact web parts or assemblies that are causing the issues. It's all explained here at least https://support.microsoft.com/en-au/topic/-type-was-not-resolvable-error-when-you-use-sandbox-solution-or-web-part-kb5015556-e37e13e5-1c33-4a64-8b93-a7cd20ef8fe9. Confirmed that this works because we had a on-prem CRM instance that integrates via sandbox code solution. Added the new AllowedListItems section with the "bugged" assembly to the web.config of the affected SP web application and the controls are working again.

Answer 2

This update contains a security fix so it's likely that these web parts aren't meeting the new security requirements. I recommend opening a support case with Microsoft Support to investigate why there seems to be a compatibility issue.