--- Ryan Dary <nug at ryandary dot com> wrote:
> I'd like to know how this "intrusion" would be
> problematic. If someone
> makes a change to something they "shouldn't" have,
> and something crashes
> because of it... so be it. They shouldn't have
> mucked around with it.
> The good rule of thumb would be, don't mess with it,
> unless you know you
> are prepared the handle the consequences.
>
> Can someone provide an example of how this
> "invasion" of private classes
> could be used. I know that some people are saying
> that it would cause
> problems, or require authors to worry that people
> are inspecting their
> objects.. but really, how could this be harmful?
Well, I'm going to play devil's advocate against
myself here... Suppose I've got an encrypted class so
you can't see what private methods and properties it
has, and one of its private properties is a Dictionary
class instance. Normally, you'd have no access to the
contents of my private Dictionary property, which
might contain, say, an encryption key, or local copies
of some private passwords or something. Just by being
able to grab arbitrary Dictionary instances, however,
you'd be able to bypass both the encryption of my
class and the scoping rules of my class data members,
and access my private Dictionary directly, thus
exposing data I, the library programmer, did not
intend or expect you to be able to see.
Hmm, it does seem that there are security implications
here I hadn't anticipated, and I'm betting it would be
fairly cumbersome to implement a version of
Runtime.GetObject that respected scoping and
encryption restrictions.
Mark Nutter
Quick and easy regex creation and debugging!
http://www.bucktailsoftware.com/products/regexplorer/
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
_______________________________________________
Unsubscribe or switch delivery mode:
<http://www.realsoftware.com/support/listmanager/>
Search the archives of this list here:
<http://support.realsoftware.com/listarchives/lists.html>
|