I just read an article about the vulnerabilities that may occur in the Java World and how to prevent them.
I immediately tried it in C # And found that. Net had the same problem. The Code is as follows:
1 using system;
2 using system. Threading;
3
4 namespace testproj
5 {
6
7
8 class vulnerable
9 {
10 int value = 0;
11
12 public vulnerable (INT value)
13 {
14 if (value <= 0)
15 {
16 throw new argumentexception ("vulnerable value must be positive ");
17}
18 this. value = value;
19}
20 public override string tostring ()
21 {
22 return (value. tostring ());
23}
24}
25
26 class attackvulnerable: vulnerable
27 {
28 static vulnerable;
29
30 public attackvulnerable (INT value)
31: Base (value)
32 {
33}
34
35 ~ Attackvulnerable ()
36 {
37 vulnerable = this;
38}
39
40 public static void main (string [] ARGs)
41 {
42 try
43 {
44 new attackvulnerable (-1 );
45}
46 catch (exception E)
47 {
48 console. writeline (E. Message );
49}
50 GC. Collect ();
51 threads. Sleep (1000); // wait for GC to complete
52 If (vulnerable! = NULL)
53 {
54 console. writeline ("vulnerable object" + vulnerable + "created! ");
55}
56 console. Readline ();
57}
58}
59}
The running result is as follows:
The obvious result is that the vulnerability exists.
The key is that the solution to the Java World provided in the original article does not know whether there is a corresponding implementation in C? I sincerely hope you will be an expert in the blog community.
In the Java World, you can execute a piece of static code in the middle of calling your own constructor and calling the object constructor (in fact, it is a base class constructor. I don't know how to implement the void in Java in C?
[Update]. Net can be implemented in this way
1 using system;
2 using system. Threading;
3
4 namespace testproj
5 {
6 class invulnerable
7 {
8 int value = 0;
9
10 public invulnerable (INT value)
11 {
12 gC. suppressfinalize (this );
13 if (value <= 0)
14 {
15 throw new argumentexception ("invulnerable value must be positive ");
16}
17 this. value = value;
18}
19
20 public override string tostring ()
21 {
22 return (value. tostring ());
23}
24}
25
26 class attackinvulnerable: invulnerable
27 {
28 static invulnerable vulnerable;
29
30 public attackinvulnerable (INT value)
31: Base (value)
32 {
33}
34
35 ~ Attackinvulnerable ()
36 {
37 vulnerable = this;
38}
39
40 public static void main (string [] ARGs)
41 {
42 try
43 {
44 new attackinvulnerable (-1 );
45}
46 catch (exception E)
47 {
48 console. writeline (E. Message );
49}
50
51 GC. Collect ();
52 thread. Sleep (1000); // wait for GC to complete
53 If (vulnerable! = NULL)
54 {
55 console. writeline ("vulnerable object" + vulnerable + "created! ");
56}
57 else
58 {
59 console. writeline ("attack failed ");
60}
61 console. Readline ();
62}
63}
64}
