Avoid exposing methods that use Platform Invocation Services to access unmanaged code | CAST Appmarq

Avoid exposing methods that use Platform Invocation Services to access unmanaged code


Rule Definition
Applications having methods exposed that use Platform Invocation Services to access unmanaged code can have security issues. These methods must not be exposed as they are accessing unmanaged code. By keeping these methods private or internal, you make sure that your library cannot be used to breach security by allowing callers access to unmanaged APIs that they could not call otherwise.

Remediation
Change access modifier to "private", "internal"or "private protected"

Violation Code Sample
Will flag a violation if "public" or "protected" or "protected internal" access modifiers are used for P/Invoke declarations

using System;
using System.Runtime.InteropServices;

namespace InteroperabilityLibrary
{ 
    public class NativeMethods
    {
        [DllImport("kernel32.dll", CharSet = CharSet.Unicode)]
        public static extern bool RemoveDirectory(string name);
    }
}
Fixed Code Sample
using System;
using System.Runtime.InteropServices;

namespace InteroperabilityLibrary
{
    public class NativeMethods
    {
        [DllImport("kernel32.dll", CharSet = CharSet.Unicode)]
        private static extern bool RemoveDirectory(string name);
    }
}

Reference
https://docs.microsoft.com/en-us/visualstudio/code-quality/ca1401-p-invokes-should-not-be-visible?view=vs-2015

Related Technologies

Health Factor

  Total Quality Index


Technical Criterion
Secure Coding - Encapsulation

About CAST Appmarq

CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.

Benchmark Statistics

Global Compliance

nan%

Total Violations
0
Total Opportunities
0
Average Violations / App.
nan
The compliance score represents 1 minus the ratio between the number of times a rule has been violated compared to the number of opportunities in a set of applications that the rule could have been violated.

Industry Insights

Software ISV

22.25%

Select from drop-down

76.41%

Telecommunications

73.92%