Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not expose Handle as IntPtr? #221

Closed
badcel opened this issue Jan 29, 2021 · 1 comment
Closed

Do not expose Handle as IntPtr? #221

badcel opened this issue Jan 29, 2021 · 1 comment
Labels
Discussion Plan the future

Comments

@badcel
Copy link
Member

badcel commented Jan 29, 2021

As IntPtr could be saved by the user. It can be used to access already freed code which is a programming error.

We could try to hide Handle again from the public API or we expose only the safe handle itself.

Afaik wrapping the safe handle again to hide the GetDangerousHandle method is only security by obscurity because a user can use reflection to get the value nevertheless.

If I remember correctly the handle is exposed just for us or other library Devs. A user of the Nuget will have no need or API available to use the handle.

With this we would only protect ourself and other library Devs against accidental access if we cache the safehandle somewhere in the code other than the object itself.

As we should never cache the safehandle (or the intptr) we could consider keeping the code as is.

I don't have a fixed opinion on this. Any thoughts or did I got something wrong with my interpretation of the situation?

@badcel badcel added the Discussion Plan the future label Jan 29, 2021
@badcel
Copy link
Member Author

badcel commented Aug 7, 2021

Closed in favor of #397

@badcel badcel closed this as completed Aug 7, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Discussion Plan the future
Projects
None yet
Development

No branches or pull requests

1 participant