有没有办法在程序集加载时运行代码?
我正在构建一个应用程序,它将加载不受信任的程序集进行检查(即检索程序集全名)。出于安全原因,我正在尝试考虑一种编写这些程序集的方法,以允许它们在加载时执行代码。我还没有用方法编写代码,但想把它扔在这里看看是否有人可以。
我知道我可以将这些程序集加载到不受信任的应用程序域中,从而有效地阻止它们执行几乎任何操作,但我想避免不必要的复杂性。
具体来说,我将调用 Assembly.Load
和
。也许有更好的方法来加载程序集名称而不使用 Assembly
类?
谢谢, 马特
I'm building an application that will load untrusted assemblies for inspection (i.e. retrieval of the assembly full name). For security reasons, I'm trying to think of a way that these assemblies could be written that would allow them to execute code when loaded. I haven't code up with a method yet, but wanted to throw it out here to see if anyone could.
I'm aware that I could load these assemblies into an untrusted app domain, effectively stopping them from doing almost anything, but I wanted to avoid the complexity if it's un-needed.
Specifically, I will be calling Assembly.Load
and <LoadedAssebmly>.FullName
. Maybe there's a better way to load the assembly name without using the Assembly
class?
Thanks,
Matt
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(2)
首先,有
AssemblyName
类。它允许您在不加载程序集的情况下找到程序集的名称。其次,您可以使用Assembly.ReflectionOnlyLoad
加载程序集,它使用仅反射上下文 - 无法从此类程序集中执行任何代码。First of all, there's the
AssemblyName
class. It allows you to find the assembly's name without loading it. Second, you can load assemblies usingAssembly.ReflectionOnlyLoad
, which uses the reflection-only context -- no code can be executed from such an assembly.是的,有可能:.Net:加载程序集时运行代码
我建议,您使用一种不加载程序集的方法来检查程序集,即
Mono.Cecil
Yes, it is possible: .Net: Running code when assembly is loaded
I suggest, you use a method to inspect the assembly, that doesn't load it, i.e.
Mono.Cecil