-Поиск по дневнику

Поиск сообщений в rss_thedaily_wtf

 -Подписка по e-mail

 

 -Постоянные читатели

 -Статистика

Статистика LiveInternet.ru: показано количество хитов и посетителей
Создан: 06.04.2008
Записей:
Комментариев:
Написано: 0


CodeSOD: The Threat of Existence

Среда, 24 Марта 2021 г. 09:30 + в цитатник

Imagine, if you will, that you see a method called FileExists. It takes a string input called strPath, and returns a bool. Without looking at the implementation, I think you'd have a very good sense of what it's supposed to do. Why, you wouldn't even expect much documentation, because the name and parameters are really clear about what the method actually does.

Unless this method was in the C# codebase "AK" inherited. In that case, the behavior of FileExists might surprise you:

public bool FileExists(string strPath) { try { File.WriteAllText(strPath, "blah"); return true; } catch (Exception ex) {/* do nothing */} return false; }

This method invokes File.WriteAllText, which does more or less what you'd expect, unlike this method.

So what this method actually does is overwrite the contents of whatever is in strPath with "blah". If it can do that write, then it returns true. If it can't do that write, perhaps because the directory doesn't exist, or the user doesn't have permission, then it returns false.

Normally, we think of "FileExists" as a check, but in this case, it's more of a threat. By the time this method executes, that file will definitely exist, if it's at all possible to create that file. And if the contents of that file were important before you called this method, well they certainly aren't now.

[Advertisement] ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

https://thedailywtf.com/articles/the-threat-of-existence

Метки:  

 

Добавить комментарий:
Текст комментария: смайлики

Проверка орфографии: (найти ошибки)

Прикрепить картинку:

 Переводить URL в ссылку
 Подписаться на комментарии
 Подписать картинку