Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unable to control script access to namespace #76563

Open
farukaf opened this issue Dec 24, 2024 · 0 comments
Open

Unable to control script access to namespace #76563

farukaf opened this issue Dec 24, 2024 · 0 comments
Labels
Area-Interactive untriaged Issues and PRs which have not yet been triaged by a lead

Comments

@farukaf
Copy link

farukaf commented Dec 24, 2024

Version Used: Microsoft.CodeAnalysis.Scripting 4.12.0

Steps to Reproduce:

.csproj

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net9.0</TargetFramework>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.CodeAnalysis.Scripting" Version="4.12.0" />
  </ItemGroup>

</Project>

Program.cs

using Microsoft.CodeAnalysis;
using Microsoft.CodeAnalysis.CSharp.Scripting;
using Microsoft.CodeAnalysis.Scripting;
using Microsoft.CodeAnalysis.Scripting.Hosting;

var scriptCode = """ 
            //This throws exception
            //System.Console.WriteLine("Hello from script");

            //This doesnt throws exception
            System.IO.Directory.CreateDirectory("C:\\TEMP\\test");
""";
var options = Empty();
var script = CSharpScript.Create(scriptCode, options, null, new InteractiveAssemblyLoader());
await script.RunAsync();

ScriptOptions Empty()
    => ScriptOptions.Default
    .WithReferences(Array.Empty<MetadataReference>())
    .WithImports();

Expected Behavior: An exception to be throw when using the unreferenced System.IO.*

Actual Behavior: An directory is created using System.IO.Directory

CSharpScript.EvaluateAsync does the same behaviour.
Tryed to find other ways to create the ScriptOptions to limit, but seems this is the more restrict way to create it.

@dotnet-issue-labeler dotnet-issue-labeler bot added Area-Interactive untriaged Issues and PRs which have not yet been triaged by a lead labels Dec 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Area-Interactive untriaged Issues and PRs which have not yet been triaged by a lead
Projects
None yet
Development

No branches or pull requests

1 participant