Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Whitelist System.Linq.Expression assembly 🙌 #56

Open
bub-bl opened this issue Nov 13, 2023 · 4 comments
Open

Whitelist System.Linq.Expression assembly 🙌 #56

bub-bl opened this issue Nov 13, 2023 · 4 comments

Comments

@bub-bl
Copy link
Contributor

bub-bl commented Nov 13, 2023

I don't think this assembly could pose any security problems.

@Metapyziks
Copy link
Contributor

System.Linq.Expressions feels pretty risky to whitelist, what did you want to do with it?

@bub-bl
Copy link
Contributor Author

bub-bl commented Nov 13, 2023

@Metapyziks Few usages exemples:

  • Im creating a UI lib with dynamic css generation (like tailwind), and if possible, give the possibility to generate dynamic property value from an expression
  • You want to create a "Coding Game", you can validate expression and get result with this assembly

@Metapyziks
Copy link
Contributor

Sadly we can't just whitelist the whole System.Linq.Expressions assembly because there are plenty of members that would let people get around the whitelist for other types. For example Expression.Call would let you call an arbitrary method by name.

The best you could hope for is us allowing specific members that we're certain are safe, but there's a lot of surface area there so it'll take a long time and isn't super high priority.

@bub-bl
Copy link
Contributor Author

bub-bl commented Nov 13, 2023

Sure, this is not a priority, but that can be good to find a way to add this kind of functionality. Maybe with a "Wrapper" like the TypeLibrary for Reflexion

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants