dohertj2/lmxopcua
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(scripting): deny System.AppContext and other process-wide mutators in the script sandbox (lmxopcua#792)
v2-ci / unit-tests (push) Waiting to run
Details

Browse Source 
ForbiddenTypeAnalyzer now denies System.AppContext, System.Console, GCSettings, ProfileOptimization,
EncodingProvider/CodePagesEncodingProvider, TypeDescriptor and CryptoConfig as types, and the ambient
CultureInfo.{DefaultThreadCurrentCulture,DefaultThreadCurrentUICulture,CurrentCulture,CurrentUICulture}
and TimeZoneInfo.ClearCachedData members (member deny-list now covers properties and member-access reads).
Shadow-mode tests diverge via culture-sensitive string.Compare (worker is InvariantGlobalization) instead of
AppContext.BaseDirectory, with a premise test. Mutation-proved: 21 new cases fail with the analyzer reverted.

Claude-Session: https://claude.ai/code/session_01GT67AEHd2Acv1YPwGfXEoV
This commit is contained in:
Joseph Doherty
2026-11-10 07:48:39 -05:00
parent b1eedceacf
commit 0e96dd08a2
5 changed files with 161 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests/ScriptSandboxHardeningTests.cs
+64
View File
@@ -145,4 +145,68 @@ public sealed class ScriptSandboxHardeningTests
"var o = System.Runtime.CompilerServices.MethodImplOptions.NoInlining; return (int)o;");
(await ev.RunAsync(new FakeScriptContext(), TestContext.Current.CancellationToken)).ShouldBe(8);
}
// ── Process-wide mutators (lmxopcua#792) ─────────────────────────────────────────────────
[Theory]
[InlineData("System.AppContext.SetSwitch(\"System.Globalization.Invariant\", true);")]
[InlineData("System.AppContext.SetData(\"k\", \"v\");")]
[InlineData("var d = System.AppContext.GetData(\"TRUSTED_PLATFORM_ASSEMBLIES\");")]
[InlineData("var b = System.AppContext.BaseDirectory;")]
[InlineData("System.AppContext.TryGetSwitch(\"x\", out var v);")]
[InlineData("var t = typeof(System.AppContext);")]
[InlineData("System.Console.SetOut(System.IO.TextWriter.Null);")]
[InlineData("System.Console.WriteLine(\"x\");")]
[InlineData("System.Runtime.GCSettings.LatencyMode = System.Runtime.GCLatencyMode.LowLatency;")]
[InlineData("System.Runtime.ProfileOptimization.SetProfileRoot(\"/tmp\");")]
[InlineData("System.Text.Encoding.RegisterProvider(System.Text.CodePagesEncodingProvider.Instance);")]
[InlineData("System.ComponentModel.TypeDescriptor.AddAttributes(typeof(string));")]
[InlineData("System.Security.Cryptography.CryptoConfig.AddAlgorithm(typeof(string), \"x\");")]
[InlineData("System.Security.Cryptography.CryptoConfig.CreateFromName(\"x\");")]
[InlineData("System.Globalization.CultureInfo.DefaultThreadCurrentCulture = System.Globalization.CultureInfo.InvariantCulture;")]
[InlineData("System.Globalization.CultureInfo.DefaultThreadCurrentUICulture = System.Globalization.CultureInfo.InvariantCulture;")]
[InlineData("System.Globalization.CultureInfo.CurrentCulture = System.Globalization.CultureInfo.InvariantCulture;")]
[InlineData("System.Globalization.CultureInfo.CurrentUICulture = System.Globalization.CultureInfo.InvariantCulture;")]
[InlineData("var c = System.Globalization.CultureInfo.CurrentCulture;")]
[InlineData("System.TimeZoneInfo.ClearCachedData();")]
[InlineData("System.AppDomain.CurrentDomain.SetData(\"k\", \"v\");")]
[InlineData("System.Environment.SetEnvironmentVariable(\"k\", \"v\");")]
[InlineData("System.GC.Collect();")]
[InlineData("System.Threading.ThreadPool.SetMinThreads(1, 1);")]
[InlineData("System.Threading.Thread.CurrentThread.CurrentCulture = System.Globalization.CultureInfo.InvariantCulture;")]
public void Rejects_process_wide_mutators(string statement)
{
var ex = Rejects(statement + " return 0;");
ex.Rejections.ShouldNotBeEmpty();
ex.Message.ShouldContain("sandbox");
}
[Fact]
public void AppContext_rejection_names_the_type()
{
var ex = Rejects("System.AppContext.SetSwitch(\"a\", true); return 0;");
ex.Rejections.ShouldContain(r => r.Message.Contains("System.AppContext") && r.Message.Contains("forbidden-type"));
}
[Fact]
public void CultureInfo_member_rejection_names_the_member()
{
var ex = Rejects("System.Globalization.CultureInfo.DefaultThreadCurrentCulture = null; return 0;");
ex.Rejections.ShouldContain(r => r.TypeName == "System.Globalization.CultureInfo.DefaultThreadCurrentCulture");
}
[Fact]
public void Legitimate_culture_and_time_usage_still_compiles()
{
// CultureInfo itself, its Invariant / named-lookup entry points and ordinary formatting stay usable.
ScriptEvaluator<FakeScriptContext, int>.Compile(
"""
var inv = System.Globalization.CultureInfo.InvariantCulture;
var de = System.Globalization.CultureInfo.GetCultureInfo("de-DE");
var s = (1.5).ToString("F2", inv) + 2.5.ToString(de) + string.Format(inv, "{0}", 3);
var tz = System.TimeZoneInfo.Utc;
var n = System.TimeZoneInfo.ConvertTimeFromUtc(System.DateTime.UtcNow, tz);
return s.Length + 1 + System.Math.Abs(-1);
""").ShouldNotBeNull();
}
}