ashmind / unbreakable Goto Github PK

Please consider allowing System.Buffers namespace. Currently:

class Program
{
    static void Main() => System.Buffers.ArrayPool<char>.Shared.Rent(10);
}

throws:

Unbreakable.AssemblyGuardException: Namespace System.Buffers is not allowed.

Take a simple scenario including a non-exhaustive switch expression:

int x = 0;
_ = x switch { 1 => 2 }; // warning CS8509: The switch expression does not handle all possible values of its input type (it is not exhaustive). For example, the pattern '0' is not covered.

It looks like the type System.Runtime.CompilerServices.SwitchExpressionException needs to be explicitly allowed by Unbreakable for this to be allowed to run on SharpLab.

https://sharplab.io/#v2:EYLgtghglgdgNAFxAJwK7wCYgNQB9YIAEAHoQLyEAMA3ALABQA+uSYQM4DuUCAxgBaEA3oQCM5AHyEATIQC+dekA

Required for e.g. Microsoft.FSharp.Core.FSharpFunc2`.

https://unbreakable-test.azurewebsites.net/?code=K4Zwlgdg5gBAygTxAFwKYFsDcBYAUKSWRFDAOgGEB7AG2tQGNkxKIRSBxVCVAJzHpz5w0eEjTpSAOVTJBBEcXFSZy5AHdKPANYBJCADNN6AIZMWc4UTFkASsAhN0qUnrQ9KABzi8Abv1QggngQxk4gHsb0qDAAIpTI0sgopqQAMmAARngA3ngw%2BTAewBnU%2FDAoPMCMMFQQ3IzMEHqGPCZmEHkFubgFvYXFpfQwAAruyJT0NAAqCB7Ro%2FETNDDZMFAymDCQbiHU5RswAL6dff0lZTrDAKIQACbDlNswqRPG1Df3jw4rawfbvLt9rIjic%2BkVzkNLh8Hk8bBh4qhoV9kD91sD%2FjxASADsceqczoMYFN6F5kKZonAyWhUX8HAC3kDNrj8QSysAngsoiAQDpbjT0XTMQzscDcaDehjAbV6u1mkZTI0ABSXAASqGocx4pAAsjoAEIAfSm5GGNgA8gB1A2WyRXGwG4Y6GIwZAkmyUNQASnFXR9p2QAAswGxKeSYABeGCK4mk8me10ed1qUi3NShtCCFm9QPB0icgI8vmRhNJlNqM1qCCEYZgW5BPFZrbfaivagPHgoyOKksessvehvdvIADaAAYALowAA8U5gAA5PTAANRRnvJ1P9weaEcARnHi5X3bdvY3raHw4ATJOZzALwAWA%2Br4%2FrtSbtvb4cAZmvs53ADZPUzRsYBbEQWwHagAEFbluHgCwjF1nz7VtoNgoDGxzNg3yRJ5I24NQYChO4YQcRVwLeVC4O5AAaECz23QC8D9Ponjg9AESHBCj0TE81Dhdi0HPCdp1nBdlyfHiX34jiPz3R9uNLVNpMEj8rxE28H3EhTeOU1Bz2%2FdT%2F0Yhss1A2A2IRSj4OLJClPhNBKPQrNMNIXScO%2BPDUAIojPm2RULIcmCqJAWiAr0hj62AkYxiWPZIwWcZJmoGY5lIY1hic3oxRMiVBSlFgZUaOVWgVFhlWGNUNV4HV9SNE0%2F3NK0bTtB0nUQjwGo9b0ct9Hr%2FSDEMqWiLsY3TVB4xJTqXzGzL8Rc%2FNuV5BCEymssKyraAazrJi%2Br6AB6PaiTNGIzQALhGYweGxQjhh8P8YGMIKC2Y3KUXI98Oy4lbFNfeiOzHH953k77eLfc85K0kGXzB1TAfvYHJp%2BmH%2FoMm8jNm04MgQNBh0nd6rO5ZbEd7Ko30cl6Chc7DiORBCIGAWhNgOmB8Ju9zkDIlCnpouiIKHYyoop%2FJWPs8LPq7KGy10oTAbEw9JbsgSxd3fdIeJqTRfPNSb3htWOp%2B6WP1R38AIxvosZxycwoJkAif1kn6F08nduzAbXNF9m6YZ6gmcO1mfJIjnre5kKYDC%2FnIuAhLYoQ6OkpS5x0rN7KWUlBlpQYWUDHldpysqzUasNABVGJTUta0LVte1HWdYBbkk7qWW6KKXLGhDRqG0gi4gLQIA9CAzdd3MFsLBC68ktbK2rWtI8bJ53s4rtx6Rv6R2Em85ajZfQdX4cIcPbfod37XZ11g%2F65XvmjcB9GhbosCudg6yYEP5CIOdlu3ep3yPJZry2Zpn5fGIdaILwijtKKB0RZK0XlvC%2BOlNYfnXqJeSr9FYyX%2BvvOBE90EqX%2BifDSqD4EaxgdfQyps74HTMmHUWNsx7EKlrQoKg9KZuzcoA3%2B9NGYQKjjFJKsc%2BHTFmM4EuGVmLMgKCnAo4JCRcGAOgaKix47CNBM3fE6VqLMVEaCKR%2BQZFlGSEwIY9BqDGEJokQxqjmL6OMSwFA5RkB8BEAAMRzpSJxsBIwACJ8jZFHNRAAtAAdkONkHcgSLyflCReWiATImhM%2FIE%2F8oS7yHC8WbGxMBJisBRBUQgMA1SPV4AhLxAAdCAkEGg%2BGiBnBodjynlPyNHfIb4YB0KzK4uCYAoAQDaSHFkbdGw13STw04mTDEXBuPI3gxgSioCnLUrOLQ2iNAAHwwE4MgRZjQQCKkbviNRjYfCXRoSABmSQ6b%2F3SCgBZBVM5FWziVdoqy9mzyzMcngLpZl0ANB4RxCFXDDEcaQAAWrwSgLDhbfDJHMg0dBemRlHG81O%2BgoyqnVAXTZVwAAeaA7ioFuDGKY3zUDdhJb8xxoVUCophT8%2BFtFHHAFQLRdFVUtSXANAANTtHAHQZpJCkEgs4g0OhbRTBZRVDF1V0pGkgnqVIVwDTkFSJBOAcA0omllfKxVzVq5OgNJBVIqRFwAEJEX7MbIcqKLoeAIDvr0K11rKbkr%2BZ8yM2pLogADG8QVtAJgqnYC2DIbwyWwvhcZe1%2BIwCorzlKrUWLcVcFuASolJLQ0%2FNdVSml5L6U2qZRK%2FO1UOXcpsLy%2FlgrhWiquOKm6hatQyqmHKhVSqVVqo1cMLVzbdWtRiAao1i5wzmsjacR1Tq%2BgfK%2BXMrirKC66kNOlRt2qK5Vx7Z6D1V1vXUDzI4qYlB3FVGQMAOC6bUAUp4Ay4RlB9CxrZYXOqwxF1dsri1GunoBZjpZBO9waggVurRQ4X9npFSc2gPGF1%2FyVzrq9T6uAYAABeqAzTXtpc4VMkh5E3EcWAAIb7kUfoKC0KMTwwAISRVsack66BlnQ%2BgTDfAAibDAEuJcFr8MOuHdaqi5y2CoUVKzbZLBiorLKje2dtV0qNWXS%2Bp0a7PWbu3TwXd%2B7GBHtJd%2B39F65hXtE9VOd97JPdtfW%2B99bGWTqf%2BV2QFjigMgagJ6cznzINyZg%2FBxDyHL3Xpnbp8TJoDPPr1TEYzkLrUSLY6FkLHH9CQDeNQO1LsDkcYlDGlDZ6YBmsIgB4FYL3CsY%2FaOtjUH5POLgqgANQaQ0pddSZ%2FD4WP2VYsxl5Av7QXguCyyFL8LSNtckXfXRWZo1oslbehNeLk2EpJMSuZJ6z1Zso6e3NjLmW1rjS4DtJay0CqFSKsVf4C0rYbU2xVyrVXqoO0uwz%2BrDXGrS0O%2BLviOOOLi3lxLzrYWuoQoVn1kE%2FX0DK5QYN1Bpvhrw06gbOn40yBxaNlNE2031fPTQ7NYauAMsqEtrz7K1s8r5ZtytO29u3rO8247baic6v8z2vt13B0wFHLlsd%2BX8MTpQ9OobYn531UfeTldr7Ptbt%2FUpxlKnj3w806gbTGO73pT%2FFzqTAXcMvdOF%2Bj0v7p2ZZ4DZsyYG3sQZgHz0gsGENIZPdRjDDh6MgAV7gRXfRCOKmI118js4UOm9o%2Bb7DgQtjMfp2xxnpnTnccFTBPj%2F8BNNEecJiAwHJd6el35nnMn9cC73ULw9x6HNi4l2z7zHPhgNXLhdwLQWbdmZVw15U6vNcsDsw58S%2BvDdue7B58HUv6rx%2Bk0X6r%2Fvatjp742PvWYou7Fixxv3wEwfw5u415r2XKA%2B%2BtWPp1%2BviuoFK4G%2F7FXwMa%2B66cAfLct8AvVy19wO%2B%2Bgda4F1jje%2BevW7u1sGNkuRtJoJUXeuk26DTczYjubcKUd5vR9npjlytjuWltlWjWpLqIp2kdq2uqlAbLoXqardlFIvmfraqPjbpPu6s5lut9uBH9gDkDlwBGnfiioNnWhwJDomvircK%2Fh4O%2FqSqLt%2FufhAKjvmstresWiAbjtttWgTgXPAYdi2idl3KXNAXLquhGMgaZqgVFMziSqzhQXpqIggRTrzjgQpoLpUMLowVvpnp5oAXeioUIYgV3qZsrj%2BuXlZhrsBlrpPk5hui5kbshiSq7nRh7lbiXgRpoERt8CRoioxhRi7mhmblhgxl7ixl4fdqQWOlxtQEkEHrcCHgRGHkJqVFHi3soaXO3vLknjuintoWnmpmXgjsgM3jHrVKIjkausXjEU6rXpZpXrYdXvZiUXXhoQ3sbmUVpgYUoZUdkQXmoTJlbv7llDbtfrvpFtFrQE9gzjbhPgfultYcfnPjbrIcBMviVgQZvjrtvuMZgTmhfgEVfr1qMlmHBGnr0nEUkMnDomceMlSGUCYmYrbB3OSFDlwOAHYlYrtA8QqEMHkiILuhYlSGNN2ANESCSG3IYuNMxKgSAGoGAK6AGFGDCfPuxnUVkmYtEG8WgGkMGHiqdDbhcUer0l4qkDoHAFMFcJIKKuwCMrfh%2BgONdLic4FcMkOcF6gSkSZib0CSZiDAF4lcFSU2pSSqFcDEAyRxsyTiVCZ3FMGAE4BaMYEiTyf7vyWSVMDoNqIqhaJBDoFMAyVFH1mZjIKSQ4uSGlAUYQK8uIncbgIcEAA

I have discovered a security vulnerability that can potentially crash an application that uses Unbreakable.

Despite having not managed to reliably reproduce it on a local SharpLab instance I created, running an exploit in LINQPad had the effect I anticipated.

Its fix is easy but since the project is not very active I am not sure how quickly it would be merged and deployed had I just applied the PR.

With that in mind @ashmind, is there any way for me to privately tell you the details of that issue?

(by @xoofx)
https://twitter.com/xoofx/status/872091640504209408

https://gist.github.com/xoofx/628ad6b802026c780e9d2a1b1867b964

Generated by F# code (private, 1)

(by @the-ress)
https://twitter.com/the_ress_/status/871859726333743105

https://gist.github.com/the-ress/16bf5684bb15ebfcdceb30f6f2ef49af

This takes far longer than 10s to terminate.

using System;
using System.Collections.Generic;
using System.Linq;

static class Program {
    static int Run() {
        IEnumerable<string> prev = new string[0];
        for (var i = 0; i < 100; i++)
            prev = prev.Concat(prev);
        string.Join(", ", prev);
        return 0;
    }
}

(by @IUnknownPtr)
https://twitter.com/VSarkisov/status/872081960935587840

https://gist.github.com/IUnknownPtr/84823e1f6140e1c16ad297a3d412f7d4

https://unbreakable-test.azurewebsites.net/?code=
https://unbreakable-test.azurewebsites.net/?code=BYFxAcGcC4HpYK4DsBGA

(by @xoofx)
https://twitter.com/xoofx/status/872057617937559552

(by @vbfox)
https://twitter.com/virtualblackfox/status/872027718002647040

https://gist.github.com/vbfox/3004ce76a66a6a6f639ce544b8f73f10

I have a console application that I want to rewrite using Unbreakable and then run using dotnet app.dll. This currently fails with:

Unhandled Exception: Unhandled exception. System.TypeInitializationException: The type initializer for '<Unbreakable>.<RuntimeGuardInstance>' threw an exception.
 ---> Unbreakable.Runtime.GuardException: Rewritten assembly can only be used within RuntimeGuardToken.Scope().
   at Unbreakable.Runtime.Internal.RuntimeGuardInstances.Get(String idString)
   at <Unbreakable>.<RuntimeGuardInstance>..cctor()
   --- End of inner exception stack trace ---
   at Program.Main()

Since the application is in a different process than the code that is doing the rewriting, starting the scope is challenging.

What would be a good way to make this work? I think I don't actually need RuntimeGuardToken.Scope(), so simply adding a setting to AssemblyGuardSettings to disable this check should be enough for my needs. I am willing to contribute the required changes to Unbreakable, if that would be helpful.

(by @the-ress)
https://twitter.com/the_ress_/status/871864719174492160

https://gist.github.com/the-ress/cc9416ba25bceb23f4f2614773704534