R – NonPublic causing a permissions error in reflection on medium trust

asp.netmedium-trustpermissionsreflection

I must say that so far, I've probably just been darn lucky in that I've never come across the problems associated with a web site running in medium trust. I've only ever developed intranet apps or happened to have use a hosting company that runs in full trust. But the host I've been asked to use for a recent project runs at medium trust so I'm trying to get my app running this. Couple of questions – I develop on Windows XP. Can IIS on there be configured for medium trust (easier to debug) and/or is it a web.config setting? There is a wealth of information on this subject and the learning curve is steep.

Secondly, after a lot of fiddling and removing code, I think this line is causing a permissions error:

For Each FieldInfo As FieldInfo In Type.GetFields(BindingFlags.Instance Or BindingFlags.NonPublic Or BindingFlags.Public)

Can anyone clarify this is a possible candidate, esp. that NonPublic flag? This is copy & pasted code (Coding Horror highlighted the risk of this) so I've never really thought about. I assume the loop is through each field in the object both public and non-public fields – and I've read that protected fields are forbidden with reflection on medium trust.

Cheers, Rob.

Best Answer

Sorry, Reflection with NonPublic is equivalent to full trust.

If somehow I didn't have full trust but had NonPublic reflection, I could leverage that into changing my own code trust level (writable strings, etc).

Related Solutions

Java – reflection and why is it useful

The name reflection is used to describe code which is able to inspect other code in the same system (or itself).

For example, say you have an object of an unknown type in Java, and you would like to call a 'doSomething' method on it if one exists. Java's static typing system isn't really designed to support this unless the object conforms to a known interface, but using reflection, your code can look at the object and find out if it has a method called 'doSomething' and then call it if you want to.

So, to give you a code example of this in Java (imagine the object in question is foo) :

Method method = foo.getClass().getMethod("doSomething", null);
method.invoke(foo, null);

One very common use case in Java is the usage with annotations. JUnit 4, for example, will use reflection to look through your classes for methods tagged with the @Test annotation, and will then call them when running the unit test.

There are some good reflection examples to get you started at http://docs.oracle.com/javase/tutorial/reflect/index.html

And finally, yes, the concepts are pretty much similar in other statically typed languages which support reflection (like C#). In dynamically typed languages, the use case described above is less necessary (since the compiler will allow any method to be called on any object, failing at runtime if it does not exist), but the second case of looking for methods which are marked or work in a certain way is still common.

Update from a comment:

The ability to inspect the code in the system and see object types is not reflection, but rather Type Introspection. Reflection is then the ability to make modifications at runtime by making use of introspection. The distinction is necessary here as some languages support introspection, but do not support reflection. One such example is C++

C# – How to use reflection to call a generic method

You need to use reflection to get the method to start with, then "construct" it by supplying type arguments with MakeGenericMethod:

MethodInfo method = typeof(Sample).GetMethod(nameof(Sample.GenericMethod));
MethodInfo generic = method.MakeGenericMethod(myType);
generic.Invoke(this, null);

For a static method, pass null as the first argument to Invoke. That's nothing to do with generic methods - it's just normal reflection.

As noted, a lot of this is simpler as of C# 4 using dynamic - if you can use type inference, of course. It doesn't help in cases where type inference isn't available, such as the exact example in the question.

Related Topic