[.net] [Security] Checking/Restricting method contents?

Yes you can but you will also tie your classes together which is not really a very good idea. Classes that are being called from other classes should not really need to know about the class calling them.

One way you might be able to do this would be able to add an enum to the fuction call that limits the function, but that means that the caller function is resonsible for the limiting.

The other way which means your class that is being called will have to know about the classes calling it would be to do the following.

Create a basic function
public void foo(int do_something);
overide this function for each other class that can call it.
public void foo(int do_something, type_of bar);
public void foo(int do_something, type_of rod);
public void foo(int do_something, type_of cat);
public void foo(int do_something, type_of dog);
ect....

That was you could call the functions from any of your other classes. This will tighly bind your classes together but if you are ok with that I guess it will work.

theTroll

I can't tell what the "they" in "what code they are allowed to execute?" refers to. If "they" is class D, meaning you want to restrict which methods of C a D can call, and you want to do it on the C side then the only thing I can think of is to not make them public. Make them private and define an interface called, ICforD. Then C can implment that and route the interface methods to the privates. Are you worried about D being malicious or it being careless?

You could get fancier by using delegates and a home-made QueryInterface that would take an object as an argument and use attributes to figure out which combination of functions its allowed to use. The nice thing about the attribute scheme is C wouldn't need to know the specific Type of D, just that some object requesting an interface had the "D-level Rights" attribute.

Yeah, class D confused me too, is this a class derived from C or something that just creates an object from C ?

If it's derived, you could have:

if(this.GetType()==typeof(C))

In the functions, which will say if the class caller is base(true) or derived(false).

I've written about this subject before in my journal. The typical method would be to define a set of permissions and then use CodeAccessPermission to allow or deny specific permission sets.

Sorry about the class D confusion, and thanks for the replies.

I'm trying to prototype a realtime programming game.
On the fly compilation, loading, and execution of player-written code.
You can probably guess at the security issues I'm going to have to solve.

To clear up,
D is the host. Class C is the code written by the client, which is why I can't trust it.
To be honest, it was rather fuzzy in my mind when I posted. After a bit of reflection, I don't think what I asked about is feasible or practical.

Quote:

Original post by Kal_Torak Sorry about the class D confusion, and thanks for the replies. I'm trying to prototype a realtime programming game. On the fly compilation, loading, and execution of player-written code. You can probably guess at the security issues I'm going to have to solve. To clear up, D is the host. Class C is the code written by the client, which is why I can't trust it. To be honest, it was rather fuzzy in my mind when I posted. After a bit of reflection, I don't think what I asked about is feasible or practical.

Actually, as I pointed out above, that is the exact scenerio that CodeAccessPermission and customer permissions was designed for. You just need to do a bit more reading up on them to see how [grin].

I've incorporated that gem from Washu's journal in our little scripting library if you need some example code. I recall there's also a thorough rundown on CodeProject somewhere, but I can't find it atm, sorry :)