C# Discussion Boards - CodeProject

musefan2-Mar-11 23:51

musefan

2-Mar-11 23:51

...you may have your knowledge, but at least I have my youth! Poke tongue | ;-P

I see[^], exactly for the same reason why the OP is having the problem

Don't vote my posts down just because you don't understand them - if you lack the superior intelligence that I possess then simply walk away

Eddy Vluggen2-Mar-11 23:45

2-Mar-11 23:45

Girish481 wrote:
Unicode String to Hindi

Could you explain that? AFAIK, Unicode supports all characters. You're going to save it as ANSI with a Hindi-codepage?

What are you trying to achieve?

Girish481 wrote:
I am using VS 2005 Prof Edition.

Would be .NET 2.0, and that doesn't support Lambda-statements. You'll have to convert it to a real method, or upgrade to a newer version of .NET.

I are Troll Suspicious | :suss:

Girish4813-Mar-11 0:01

3-Mar-11 0:01

If it is due to older framework version; then i will test the code on another machine and will post the output/error (if any).

Thank you very much for your replies.

musefan3-Mar-11 0:06

musefan

3-Mar-11 0:06

As Eddy has said, you need to use a newer version of VS (i.e. 2008 or 2010) in order for the compiler to accept the lambda expressions. It is not just the installed version that is required

Don't vote my posts down just because you don't understand them - if you lack the superior intelligence that I possess then simply walk away

Girish4813-Mar-11 0:47

3-Mar-11 0:47

>What are you trying to achieve?

Actually i have got couple of files named like file1.txt, file2.txt etc... and these files are having unicode data too. I have to store these files data into databases like Oracle, SQL Server. So, i was in search to first convert a unicode string to convert it into editable text; i.e. something like :
Unicode String is "This is a unicode string" and i wish :
New String is : "Something text after conversion"; and then if i select hindi (an Indian Language) font for new string; it will show me the original string as it was in Unicode.

Now, here i do'nt know how do i know the complete steps to convert these files into that format; so that i can store those data into databases.

Thank you.

Eddy Vluggen3-Mar-11 1:06

3-Mar-11 1:06

Girish481 wrote:
I have to store these files data into databases like Oracle, SQL Server. So, i was in search to first convert a unicode string to convert it into editable text; i.e. something like :

Every string in .NET is in Unicode, it's the default nowadays. Meaning that you only need to read the text and pass it on to your database. Do make sure that your database also stores them in that format.

Girish481 wrote:
Unicode String is "This is a unicode string" and i wish :
New String is : "Something text after conversion";

That doesn't make sense. Unicode contains Hindi-characters - what would you want to convert them into?

Girish481 wrote:
and then if i select hindi (an Indian Language) font for new string; it will show me the original string as it was in Unicode.

Both show the original string in the same encoding, only with different fonts. Some fonts are designed for use with ANSI and a specfic codepage, others were created for unicode[^]. Your string in Hindi should look allright when displayed as unicode in one of those fonts.

I are Troll Suspicious | :suss:

Girish4813-Mar-11 3:38

3-Mar-11 3:38

I am sorry for being late reply.

Probably i am not able to explain my need. See, whatever you have said, that is fine that if i says dim x as string="Hindi Words"; they are visible in the dotnet; but i want to convert them into "editable text", wish to apply some sort of font displays like bold, italic, color change etc. so, that i can say select * from mytable where name like '%Some Search String based upon Hindi words..%'. Here issue is that they are visible in IDE and Textboxes; but how do i give select criteria in the textbox so that database can see the query as mentioned above please.

Please let me know :
1.How do i convert Unicode Text to Edibable Text?
2.It would be more helpful if you please show me some code in action.

@ the moment; i am reading below link... but Ouch...it is also returning error....

Please scorll down and read the reply posted by Atul Bari...

http://nishantpant.wordpress.com/2007/01/04/how-to-convertdisplay-a-unicode-string-in-vbnet/

and the SQL Server Error is :

Msg 102, Level 15, State 1, Procedure Hex, Line 11
Incorrect syntax near '‘'.
Msg 102, Level 15, State 1, Procedure Hex, Line 20
Incorrect syntax near '‘'.
Msg 102, Level 15, State 1, Procedure Hex, Line 29
Incorrect syntax near '‘'.
Msg 102, Level 15, State 1, Procedure Hex, Line 38
Incorrect syntax near '‘'.
Msg 102, Level 15, State 1, Procedure Hex, Line 52
Incorrect syntax near 'end'.

Thank you very much for your continue support.

Eddy Vluggen3-Mar-11 6:45

3-Mar-11 6:45

Girish481 wrote:
Probably i am not able to explain my need

No worries; text-encoding is a though subject and I'm not very good at explaining either.

Girish481 wrote:
. See, whatever you have said, that is fine that if i says dim x as string="Hindi Words"; they are visible in the dotnet;

Strings in .NET are in Unicode, in UTF8 to be precise. (UTF7, 8, 16 and 32 are all Unicode-formats), but Windows was around long before .NET - not everything is prepared for multibyte-characters. As a test, you can create a new project in Visual Studio and replace the code from Form1 with this code;

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Data.SqlClient;

public partial class Form1 : Form
{
    const String ओम् = "ॐ (that's Ohm)"; // Hindi character (both in var-name and contents!)
    TextBox myTextBox;
    RichTextBox myRichBox;

    public Form1()
    {
        InitializeComponent();

        myTextBox = new TextBox();
        myTextBox.Dock = DockStyle.Top;
        myTextBox.Text = ओम्;
        this.Controls.Add(myTextBox);

        myRichBox = new RichTextBox();
        myRichBox.Dock = DockStyle.Top;
        myRichBox.Text = ओम्;
        this.Controls.Add(myRichBox);

        String cs = "Server=.;Database=Northwind;Trusted_Connection=True;";
        using (SqlConnection con = new SqlConnection(cs))
        using (SqlCommand cmd = con.CreateCommand())
        {
            // prep command
            cmd.CommandText = "UPDATE Customers SET CompanyName = @what WHERE ContactName = @ContactName";
            cmd.Parameters.AddWithValue("ContactName", "Antonio Moreno");
            cmd.Parameters.AddWithValue("what", ओम्);
            con.Open();
            
            // update that contact to have the Ohm-string in it's companyname
            // this is to prove that the character is stored in Sql Server.
            // We'll be searching for this character in the next query;
            cmd.ExecuteNonQuery();

            // now find that contact by using the Ohm-character and the Sql like operator            
            cmd.Parameters.Clear();
            cmd.CommandText = "SELECT CompanyName + '.' + ContactName FROM Customers WHERE CompanyName LIKE @bla";
            cmd.Parameters.AddWithValue("bla", "%ॐ%"); // search for any records containing the Ohm-character in column CompanyName
            string result = cmd.ExecuteScalar().ToString();

            myTextBox.Text = result; // should display a box-character with a name (this is what you wanted to prevent)
            myRichBox.Text = result; // should display a Ohm-character with a name (this is per your requirement)
        }
    }
}

Visual Studio should complain that you're using non-standard characters and it should propose to save it in a "universal" format - that's going to be Unicode again. If you have the Nortwind-database installed than you can execute this code as is, otherwise you'll have to change the table-names.

If all is well, it'd update a record in that database and search that record again - displaying the result in both textboxes.

Girish481 wrote:
1.How do i convert Unicode Text to Edibable Text?

As the example shows, Unicode is editable. Not every control understands unicode, which might be the reason why your seeing blocks (or question marks) in certain controls. It should also be noted that most databases expect ASCII/ANSI for text-fields, having special fields for multibyte-character sets. In Sql Server, that'd be the datatypes that are prefixed with an 'N', like NVARCHAR.

Girish481 wrote:
and the SQL Server Error is :

Are you concatenating the parameter to the command (like "SELECT " + textbox1.Text) or are you using a SqlParameter to fill in the parameters of the query?

Hope this gets you going in the right direction Smile | :)

I are Troll Suspicious | :suss:

Girish4813-Mar-11 23:48

3-Mar-11 23:48

First i really wish to heartly thank to you for your continue support.

Thats a really very good, clear and helpful reply for me; but still issues are there:

1.How do i give/type Unicode in the textbox, something like :
Select * from mytable where name like '%ओम%' (Here i am copying from your reply)

I think if any how i am able to convert this ओम into "vkse" then it is how i wish to store the data in the table. Here "vkse" is the hindi translation of ओम if i select any Hindi font please;
or if you still feel that i am not explaning my need properly; please contact at my mail id i.e. gksharmaajmer@gmail.com

Thank you.

Eddy Vluggen4-Mar-11 12:16

4-Mar-11 12:16

Girish481 wrote:
First i really wish to heartly thank to you for your continue support.

You're welcome Smile | :)

Girish481 wrote:
1.How do i give/type Unicode in the textbox, something like :
Select * from mytable where name like '%ओम%' (Here i am copying from your reply)

There's a catch there, in the Sql part. If you execute that statement in Sql Server Management Studio Express (or any other Query-tool) than you'll find 0 records. The statement below should work, but..

SQL

SELECT * FROM mytable WHERE name LIKE N'%ओम%'

There's another caveat, with the .AddWithValue method on the SqlCommand class; somehow it finds 0 records again. Long story short, a bit (working) code with a workaround;

public partial class Form1 : Form
{
    const String Ohm = "ओम्";
    RichTextBox myRichBox;

    public Form1()
    {
        InitializeComponent();

        myRichBox = new RichTextBox();
        myRichBox.Dock = DockStyle.Top;
        myRichBox.Text = "ओ"; // Search part of the Ohm
        this.Controls.Add(myRichBox);

        using (SqlConnection con = new SqlConnection(
            "Server=.;Database=AdventureWorks;Trusted_Connection=True;"))
        using (SqlCommand cmd = con.CreateCommand())
        {
            cmd.CommandText = 
                "UPDATE Person.Contact SET FirstName = @what WHERE ContactID = @ContactID";
            cmd.Parameters.AddWithValue("ContactID", 25);
            cmd.Parameters.AddWithValue("what", "O" + Ohm); // write full Ohm to database
            con.Open();

            cmd.ExecuteNonQuery();

            cmd.Parameters.Clear();
            cmd.CommandText = 
                "SELECT ContactID FROM Person.Contact WHERE FirstName LIKE N'%@what%'";
            // For some strange reason, adding a parameter doesn't work
            //  cmd.Parameters.AddWithValue("what", myRichBox.Text);
            // As a workaround;
            cmd.CommandText = cmd.CommandText.Replace("@what", myRichBox.Text);
            string result = cmd.ExecuteScalar().ToString();

            myRichBox.Text = "Found record @Id; " + result;
        }
    }
}

I've used the AdventureWorks database here, but it should work equally with the Northwind database. This[^] page on MSDN has some lengthy explanation.

I are Troll Suspicious | :suss:

Girish4815-Mar-11 16:56

5-Mar-11 16:56

Even though i have not yet tried your code in my machine (VS 2010) because you are showing the code in a different approach, but my need/question is different. I agree that if i runs your code it will work fine if table is having Unicode Strings in the columns; but my question is "How i will give Unicode Strings in the Textbox to search the table" like :
select * from mytable where col1=Textbox1.Text (Here how do i supply Unicode in the Textbox).

Whereas, if i were able to store converted strings in the column then i think it is more flexible to handle the data, because now it is converted and editable to any tool. Something like if table is having Unicode values then problem is how do i supply / search in the table using textbox1 and then populate my FlexGrid.

I think its going a larger thread on the forum, thats why i gave you my mail id; so that if i gets the final and the complete answer; then i will post your code here; so that other user of the forum may get handy answer as well.

Best Regards.

Eddy Vluggen6-Mar-11 0:42

How do you protect your app hosting third party dll ...? [modified]

6-Mar-11 0:42

Girish481 wrote:
Something like if table is having Unicode values then problem is how do i supply / search in the table using textbox1 and then populate my FlexGrid.

Searching is done using the LIKE operator as shown. Giving the user an easy way to enter values would be harder; some languages would require their own IME-editor[^].

If the keyboard can't supply all characters, then you'll need one of those.

I are Troll Suspicious | :suss:

devvvy2-Mar-11 21:32

Re: How do you protect your app hosting third party dll ...?

2-Mar-11 21:32

Hi
One question - is it impossible to safe guard an application hosting third party dll?

See this thread, even if third party dll loaded into separate AppDomain, it can still access AppDomain.Current.Get/SetData[^]

In addition to AppDomain.Current.Get/SetData, can third party examine application memory. For example, hosting application may contain a secret/private key in some application context, which is used to decrypt communications or licensing file. Even if private key is not placed in AppDomain.Current.Get/SetData, is it possible for third party dll to ... perhaps "reflect" on the process memory foot print and extract the private key?

If the answer is yes - then it follows really the moment you load a third party dll into your own process, you cannot be sure if your process has been compromised?

I think security is even more important than say process isolation safe guarding against crashes in third party dll.

Thanks

NOTE: This is NOT a question on CAS[^] as setting permissions/evidence doesn't has anything to do with access to AppDomain from third party dll[^]

Also, this is not a question on serializing access to a singleton instance object[^]

dev

modified on Thursday, March 3, 2011 5:41 AM

Eddy Vluggen3-Mar-11 6:58

Re: How do you protect your app hosting third party dll ...?

3-Mar-11 6:58

devvvy wrote:
In addition to AppDomain.Current.Get/SetData, can third party examine application memory.

Yes. Wouldn't be worth the effort though. I'm running Linux, Windows-applications are executed under Wine, .NET applications are run under Mono - and I can access the source-code of the VM if need be.

devvvy wrote:
If the answer is yes - then it follows really the moment you load a third party dll into your own process, you cannot be sure if your process has been compromised?

You cannot even be sure if you don't load any external code; only if you have complete control over the environment.

I are Troll Suspicious | :suss:

devvvy3-Mar-11 15:21

Re: How do you protect your app hosting third party dll ...?

3-Mar-11 15:21

"can third party examine application memory."
> I know reflection can enumerate types of assemblies. I also know if you pass in any object (For example, a LicenseController sitting in AppDomain.Current.Get/Set), reflection can basically enumerage types/properties (set/get any "private" members and methods!). So basically anything sitting in AppDomain.Current.Get/Set is UNSECURED.
One further question out of curiosity - can third party dll can a raw byte[] image of process memory...?

"and I can access the source-code of the VM if need be."
> Access source code? Even if I use an obfuscator..!?

So all this jazz about AppDomain are *practically useless* from security stand point. I've also tried to throw an exception from code from another appDomain, it crashes the whole app (see below).

Sounds like all theories surrounding appDomain completely b*llsh*t!

<br />
using System;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
using System.Threading;<br />
using System.Reflection;<br />
using System.Security.Policy;<br />
<br />
using UserUtil;<br />
using SimpleUtil;<br />
<br />
namespace SimpleTest<br />
{<br />
    class Program<br />
    {<br />
        public const string KEY1 = "KEY1";<br />
        public static AppDomain UserDomain = null;<br />
        public static SimpleUtil.IServiceProvider UserProvider = null;<br />
<br />
        static void Main(string[] args)<br />
        {<br />
            Assembly UserAssembly = null;<br />
            Object oProvider = null;<br />
            Thread t = null;<br />
<br />
            try<br />
            {<br />
                AppDomain.CurrentDomain.SetData(KEY1, "PrivateKey");<br />
<br />
                UserDomain = AppDomain.CreateDomain("UserDomain");<br />
                UserDomain.SetData(KEY1, "Sh*t!");<br />
                <br />
                UserAssembly = Assembly.LoadFrom("UserUtil.dll");<br />
                <br />
                oProvider = UserDomain.CreateInstanceFrom("UserUtil.dll", "UserUtil.ServiceProvider").Unwrap();<br />
                // oProvider = UserAssembly.CreateInstance("UserUtil.ServiceProvider");<br />
<br />
                if (oProvider != null)<br />
                {<br />
                    if (oProvider is SimpleUtil.IServiceProvider)<br />
                    {<br />
                        UserProvider = (SimpleUtil.IServiceProvider)oProvider;<br />
<br />
                        t = new Thread(new ParameterizedThreadStart(Program.AsyncDoWork));<br />
                        t.Start("Calling UserProvider.DoWork");<br />
                    }<br />
                }<br />
<br />
                while (true)<br />
                {<br />
                    Console.Write(".");<br />
                    Thread.Sleep(1000 * 5);<br />
                }<br />
            }<br />
            catch (Exception Ex)<br />
            {<br />
                Console.WriteLine(Ex.Message);<br />
            }<br />
<br />
            return;<br />
        }<br />
<br />
        public static void AsyncDoWork(object Arg)<br />
        {<br />
            string Message = null;<br />
            Message = (string)Arg;<br />
            UserProvider.DoWork(Message); << If inside third party "DoWork" throws an exception, it'd crash the hosting app even it's instantiated from different AppDomain! Also it can access AppDomain.Current.GetData("SomeSecret"). On these two reasons - all this talk about AppDomain isolation are quite pointless.<br />
            return;<br />
        }<br />
    }<br />
}<br />

dev

Eddy Vluggen4-Mar-11 11:04

Re: How do you protect your app hosting third party dll ...? [modified]

4-Mar-11 11:04

devvvy wrote:
can third party dll can a raw byte[] image of process memory

Yes/No. Most games that were created before the .NET era were cracked, despite some huge investments in copy-protection. It's not doable to reverse-engineer the entire code, but that's rarely done at all - bypassing the protection or getting the password to the database is often enough.

devvvy wrote:
So all this jazz about AppDomain are *practically useless* from security stand point. I've also tried to throw an exception from code from another appDomain, it crashes the whole app (see below).

Sounds like all theories surrounding appDomain completely b*llsh*t!

Again, yes and no. An AppDomain isn't a new security-feature, it's an isolationlevel for applications. One that can be unloaded, if desired. It also means that I can execute (potentially malicious) code in a sandboxed environment[^], increasing my overall security. The code in that sandbox is restricted in what it can and cannot do.

I'm running Linux, and I have the source-code to the Operating System, as well as the Mono source-code. It'd be some work, but it could be used to backtrack what API's you're calling - even the paramaters that you pass aren't safe from prying eyes.

devvvy wrote:
all this talk about AppDomain isolation are quite pointless

Depends on what you wants it for, and how secure you need to be. Do you need to prevent an ordinary user from making modifications? Prevent someone from seeing the users' data? Or are you creating an application for a nuclear plant?

In the first case, encryption would suffice. In the second case, obfuscation would suffice. In the last case, you simply need total control over the machine - then you'd only be vulnerable for stuxnet Smile | :)

I are Troll Suspicious | :suss:

devvvy4-Mar-11 22:28

Re: How do you protect your app hosting third party dll ...?

4-Mar-11 22:28

Hello I tried out your advice - MSDN article on sand boxing third party dll [^]

The following code created new AppDomain for third party dll, invoke it and found out that AppDomain.Current.GetData[KEY1] refers to that of the "New Domain" (not old AppDomain of hosting app)

But again, two problems still remains:
a. third party can still access all AppDomain - see this.[^]
(But if MSDN is correct, GetCallingAssembly requires ReflectionPermission as well - so DENY ReflectionPermission is very key)[^]

b. third party library can simply retrieves hosting types by GetCallingAssembly

<br />
public void DoWork(string Message)<br />
        {<br />
            // For some reason keeps getting "Exception of type 'System.ExecutionEngineException' was thrown." when there're more than one class other than "Program.cs" but this worked otherwise (i.e. I think my DENY ReflectionPermission didn't work!) ...<br />
            Type[] Types = Assembly.GetCallingAssembly().GetTypes();<br />
            if (Types != null)<br />
            {<br />
                foreach (Type t in Types)<br />
                {<br />
                    Console.WriteLine("Detected type: " + t.FullName);<br />
                }<br />
            }<br />

c. Am I doing it right below on how to DENY ReflectionPermission? (By setting PermissionState.None)

Anyway here's my full test code.

<br />
***** Program.cs *****<br />
using System;<br />
using System.IO;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
using System.Threading;<br />
<br />
using System.Reflection;<br />
using System.Security;<br />
using System.Security.Policy;<br />
using System.Security.Permissions;<br />
<br />
using UserUtil;<br />
using SimpleUtil;<br />
<br />
namespace TestAppDomain<br />
{<br />
    class Program <br />
    {<br />
        public const string KEY1 = "KEY1";<br />
        public static AppDomain UserDomain = null;<br />
<br />
        static void Main(string[] args)<br />
        {<br />
            string UntrustedThirdPartyDir = @"..\..\UserUtil\UserUtil\bin\Debug";<br />
            string ThirdPartyDll = "UserUtil.dll";<br />
            string ThirdPartyServiceFullyQualifiedName = "UserUtil.ServiceProvider";<br />
<br />
            Assembly UserAssembly = null;<br />
<br />
            Object oProvider = null;<br />
            SimpleUtil.IServiceProvider UserProvider = null;<br />
<br />
            try<br />
            {<br />
                #region Sandbox preparation<br />
                // http://msdn.microsoft.com/en-us/library/bb763046.aspx<br />
                // http://www1.cs.columbia.edu/~lok/csharp/refdocs/System.Security.Permissions/types/ReflectionPermission.html<br />
                // http://www1.cs.columbia.edu/~lok/csharp/refdocs/System.Security.Permissions/types/ReflectionPermissionFlag.html<br />
                AppDomainSetup AdSetup = new AppDomainSetup();<br />
                AdSetup.ApplicationBase = Path.GetFullPath(UntrustedThirdPartyDir);<br />
<br />
                PermissionSet PermSet = new PermissionSet(PermissionState.None);<br />
                PermSet.AddPermission(new SecurityPermission(SecurityPermissionFlag.Execution));<br />
<br />
                // QUESTION: How to DENY reflection permission...? Am I doing it right? (I don't think it is)<br />
                ReflectionPermission RefPerm = new ReflectionPermission(PermissionState.None);<br />
                PermSet.AddPermission(RefPerm);<br />
<br />
                StrongName FullTrustAssembly = typeof(Program).Assembly.Evidence.GetHostEvidence<StrongName>();<br />
                #endregion<br />
<br />
<br />
                UserDomain = AppDomain.CreateDomain(<br />
                    "UserDomain", null, AdSetup, PermSet, FullTrustAssembly<br />
                    );<br />
<br />
                AppDomain.CurrentDomain.SetData(KEY1, "PrivateKey");<br />
                UserDomain.SetData(KEY1, "NoProblem!");<br />
<br />
                oProvider = Activator.CreateInstanceFrom(<br />
                    UserDomain, ThirdPartyDll, ThirdPartyServiceFullyQualifiedName<br />
                ).Unwrap();<br />
<br />
                #region No need for this...<br />
                // oProvider = UserDomain.CreateInstanceFrom("UserUtil.dll", "UserUtil.ServiceProvider").Unwrap();<br />
                #endregion<br />
<br />
                #region No need for this either ..<br />
                // UserAssembly = Assembly.LoadFrom("UserUtil.dll");<br />
                // oProvider = UserAssembly.CreateInstance("UserUtil.ServiceProvider");<br />
                #endregion<br />
<br />
                if (oProvider != null)<br />
                {<br />
                    if (oProvider is SimpleUtil.IServiceProvider)<br />
                    {<br />
                        UserProvider = (SimpleUtil.IServiceProvider)oProvider;<br />
<br />
                        Object[] parameters = { "Calling UserProvider.DoWork" };<br />
<br />
                        while (true)<br />
                        {<br />
                            #region OPTION 1: prints out "UserUtil.DoWork - secret=NoProblem!"<br />
                            // UserProvider.DoWork("Calling UserProvider.DoWork");<br />
                            #endregion<br />
<br />
                            #region OPTION 2: prints out "UserUtil.DoWork - secret=NoProblem!"<br />
                            UserProvider.GetType().GetMethod("DoWork").Invoke(UserProvider, parameters);<br />
                            #endregion<br />
                        }<br />
                    }<br />
                }<br />
            }<br />
            catch (Exception Ex)<br />
            {<br />
                Console.WriteLine(Ex.Message);<br />
            }<br />
<br />
            return;<br />
        }<br />
    }<br />
}<br />
<br />
*** SimpleUtil.ServiceProvider ***<br />
using System;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
using System.Runtime.Serialization;<br />
<br />
namespace SimpleUtil<br />
{<br />
    [Serializable()]<br />
    class ServiceProvider : SimpleUtil.IServiceProvider<br />
    {<br />
        public void DoWork(string Message)<br />
        {<br />
            Console.WriteLine("SimpleUtil.DoWork");<br />
            return;<br />
        }<br />
<br />
        public ServiceProvider()<br />
        {<br />
            return;<br />
        }<br />
<br />
        public ServiceProvider(SerializationInfo info, StreamingContext context)<br />
        {<br />
            return;<br />
        }<br />
<br />
        public void GetObjectData(<br />
            SerializationInfo info,<br />
            StreamingContext context<br />
        )<br />
        {<br />
            return;<br />
        }<br />
   <br />
    }<br />
}<br />
<br />
using System;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
using System.Runtime.Serialization;<br />
<br />
namespace SimpleUtil<br />
{<br />
    public interface IServiceProvider : ISerializable<br />
    {<br />
        void DoWork(string Message);<br />
    }<br />
}<br />
<br />
<br />
***** UserUtil.ServiceProvider *****<br />
using System;<br />
using System.Collections.Generic;<br />
using System.Linq;<br />
using System.Text;<br />
<br />
#region "Inheritance security rules violated while overriding member" runtime error<br />
/*<br />
ATTN: <br />
In implementing ISerializable of class below, you'd need to override "GetObjectData" and in .NET 4, this'd give runtime error <br />
    "Inheritance security rules violated while overriding member: 'UserUtil.ServiceProvider.GetObjectData(System.Runtime.Serialization.SerializationInfo, System.Runtime.Serialization.StreamingContext)'. Security accessibility of the overriding method must match the security accessibility of the method being overriden."<br />
This runtime error happens when:<br />
       oProvider = Activator.CreateInstanceFrom(<br />
                    UserDomain, ThirdPartyDll, ThirdPartyServiceFullyQualifiedName<br />
                );<br />
Two options:<br />
 a. [assembly: SecurityRules(SecurityRuleSet.Level1)]<br />
    But this relaxes defaults, and thus undesirable<br />
 b. Apply attrib below - unfortunately it doesn't work<br />
    [SecurityCriticalAttribute()] --> This requires "using System.Security"<br />
        public void GetObjectData(<br />
            SerializationInfo info,<br />
            StreamingContext context<br />
        )<br />
        {<br />
            return;<br />
        }<br />
REF: <br />
 http://stackoverflow.com/questions/3055792/inheritance-security-rules-violated-while-overriding-member-securityruleset-lev<br />
 http://msdn.microsoft.com/en-us/library/system.security.securitycriticalattribute.aspx<br />
 */<br />
#endregion<br />
<br />
using System.Security;<br />
using System.Security.Policy;<br />
using System.Security.Permissions;<br />
<br />
using System.Runtime.Serialization;<br />
<br />
using SimpleUtil;<br />
<br />
namespace UserUtil<br />
{<br />
    [Serializable()]<br />
    public class ServiceProvider : MarshalByRefObject, SimpleUtil.IServiceProvider<br />
<br />
    {<br />
        public void DoWork(string Message)<br />
        {<br />
            // throw new Exception("Testing - Exception blowing up in third party library (still kills the hosting app what the hell)");<br />
<br />
            object oSecret = null;<br />
            string secret = null;<br />
<br />
            oSecret = AppDomain.CurrentDomain.GetData("KEY1");<br />
            if (oSecret != null)<br />
            {<br />
                secret = (string)oSecret;<br />
                Console.WriteLine("UserUtil.DoWork - secret=" + secret); // This is accessing new/UserUtil AppDomain!! Good!<br />
            }<br />
            else<br />
            {<br />
                Console.WriteLine("UserUtil.DoWork - secret=NULL!");<br />
            }<br />
            return;<br />
        }<br />
<br />
        public ServiceProvider()<br />
        {<br />
            return;<br />
        }<br />
<br />
        public ServiceProvider(SerializationInfo info, StreamingContext context)<br />
        {<br />
            return;<br />
        }<br />
<br />
        [SecurityCriticalAttribute()]<br />
        public void GetObjectData(<br />
            SerializationInfo info,<br />
            StreamingContext context<br />
        )<br />
        {<br />
            return;<br />
        }<br />
    }<br />
}<br />

dev

modified on Saturday, March 5, 2011 6:47 AM

Eddy Vluggen5-Mar-11 3:02

Re: How do you protect your app hosting third party dll ...?

5-Mar-11 3:02

devvvy wrote:
a. third party can still access all AppDomain - see this.[^][^]

It's not designed to be a security-feature where you prevent others from looking at your public properties;

MSDN[^] wrote:
Controls access to non-public types and members through the System.Reflection APIs

The weakest link would be the .NET-environment itself. Again, what are you securing here? If it's your business-logic, then you might want to consider webservices - that way the other person doesn't have physical access to your code.

I are Troll Suspicious | :suss:

devvvy5-Mar-11 14:24

Re: How do you protect your app hosting third party dll ...?

5-Mar-11 14:24

For starter, licensing.

But been hearing CAS is becoming out of favor and MSDN sandbox example relies on CAS[^]

I'm still trying to "Deny" reflection permission (Third party can call "GetCallingAssembly().GetType())

<br />
/*<br />
                 * ATTN: When set to "ReflectionPermissionFlag.MemberAccess", all instance members (public|protected|private) are accessible from ThirdParty dll DoWork.<br />
                 *       However, static members are not.<br />
                 <br />
                    Detected type from ThirdParty via reflection: TestAppDomain.Program<br />
                    Detected fields: StaticKey, Exception while trying to access property value: Request failed.<br />
                    Detected fields: UserDomain, Exception while trying to access property value: Request failed.<br />
                    Detected fields: KEY1, Value: KEY1<br />
                    Detected fields: KEY2, Value: KEY2<br />
                    Detected fields: KEY3, Value: KEY3<br />
                 */<br />
                ReflectionPermission RefPerm = new ReflectionPermission(ReflectionPermissionFlag.MemberAccess);<br />
                // RefPerm.Deny(); // Obsolete in .NET 4! How else can I do it?<br />
                PermSet.AddPermission(RefPerm); // Not adding the permission doesn't work, third party lib in sandbox can still reflect by default.<br />

dev

Eddy Vluggen7-Mar-11 0:41

Re: How do you protect your app hosting third party dll ...?

7-Mar-11 0:41

I believe the sandbox is meant to prevent other people's code from doing stupid things, not to keep the user out. It might be more efficient to buy an existing system to protect your software.

I are Troll Suspicious | :suss:

devvvy7-Mar-11 14:27