Joseph Doherty
9cff87fe85
Remove project bookkeeping citations from shipped code comments across the solution: hyphenated task IDs (WP-14, StoreAndForward-025), milestone/task/ issue refs (M3, Task 4, Audit Log #23, #21), Bundle X task-bundle labels, and C/D/K/S/T phase labels. Comment text only — no code logic, string/log literals, or XML-doc structure changed. Genuine descriptions are preserved (only the citation is stripped), and technical lookalikes are retained (UTF-8, SHA-256, T00:00:00, M365, UTC-5, pre-C4/pre-C5 schema versions). Flagged by the new CommentChecker TaskReferenceInComment / TrackingReferenceInComment checks plus targeted grep passes; full solution builds clean, append-only guard tests pass.
47 lines
2.2 KiB
C#
47 lines
2.2 KiB
C#
using ZB.MOM.WW.ScadaBridge.ScriptAnalysis;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.InboundAPI;
|
|
|
|
/// <summary>
|
|
/// Enforces the ScadaBridge script trust model on inbound API method
|
|
/// scripts before they are compiled into executable handlers.
|
|
///
|
|
/// This class is now a thin shim that delegates to the shared, authoritative
|
|
/// <see cref="ScriptTrustValidator.FindViolations"/> implemented in
|
|
/// <c>ZB.MOM.WW.ScadaBridge.ScriptAnalysis</c>. The unified validator runs
|
|
/// both a semantic symbol pass (catching alias / <c>global::</c> / <c>using static</c>
|
|
/// escapes) and the reflection-gateway + <c>dynamic</c> / <c>Activator</c> syntactic
|
|
/// hardening that previously lived exclusively in this file.
|
|
///
|
|
/// <para>
|
|
/// A purely namespace-textual deny-list is bypassable because
|
|
/// reflection is reachable through members of <em>permitted</em> types that never
|
|
/// spell a forbidden namespace, e.g.
|
|
/// <c>typeof(string).Assembly.GetType("System.IO.File")</c>. The shared validator
|
|
/// handles this with both semantic resolution and reflection-gateway member
|
|
/// hardening — <c>GetType</c>, <c>Assembly</c>, <c>GetMethod</c>, <c>InvokeMember</c>,
|
|
/// <c>CreateInstance</c>, and the <c>dynamic</c> keyword are all rejected. This
|
|
/// remains hardening of a best-effort static check, <strong>not</strong> a true sandbox
|
|
/// (see the security notes in <c>code-reviews/InboundAPI/findings.md</c>).
|
|
/// The check is defence-in-depth; genuine containment needs a
|
|
/// runtime boundary (restricted <c>AssemblyLoadContext</c> / curated reference set /
|
|
/// out-of-process sandbox).
|
|
/// </para>
|
|
/// </summary>
|
|
public static class ForbiddenApiChecker
|
|
{
|
|
/// <summary>
|
|
/// Analyses the script source and returns the list of trust-model violations.
|
|
/// An empty list means the script is acceptable.
|
|
/// </summary>
|
|
/// <param name="scriptCode">The C# script source to analyse.</param>
|
|
/// <returns>A list of trust-model violation messages; empty if the script is clean.</returns>
|
|
public static IReadOnlyList<string> FindViolations(string scriptCode)
|
|
{
|
|
if (string.IsNullOrWhiteSpace(scriptCode))
|
|
return Array.Empty<string>();
|
|
|
|
return ScriptTrustValidator.FindViolations(scriptCode);
|
|
}
|
|
}
|