June 28, 2006
05:12 PM
I came across the MSR paper Securing the .NET Programming Model by way of Lambda the Ultimate. It describes various abstraction leaks from C# through compilation to IL. If you have dug around in IL you are probably aware of most of the Party tricksroblems mentioned. Unfortunately not everyone is so lucky, programmers could draw incorrect conclusions from the abstractions their source language defines and unknowingly introduce security holes. Fixing the abstraction leaks helps to minimise the surface area that programmers need to be aware of in order to write secure code. I was somewhat shocked, not that abstraction shortcomings existed - but I was unaware of the breaking changes removing a bunch of party tricks from CLR 2.0. I am surprised that no languages actually relied on these features. I guess CLR 2.0 relegates the throwing of non-exception types, calling base implementations of overriden methods and modifying boxed value types to the storytelling of grandchildren about the old days of the CLR.
© Douglas Stockwell 2007
Creative Commons License Unless otherwise specified all "source code" examples are available for use under the Creative Commons Attribution-Noncommercial 3.0 License. Please contact me if you would like more flexible licensing terms.
Messenger Presence