I recently ran static code analysis in Visual Studio on a solution and saw a line get flagged for CA2104. Mutable object marked as ReadOnly. I understand why it doesn't make sense to have a mutable type set as ReadOnly, since the properties on the object can change, but I don't understand why this is considered a security problem.
This seems more like a data integrity/code quality problem. The only security related thing that comes to mind is if the user was able to somehow change the properties, they could potentially make the object behave in a different manner, but wouldn't this be true for any mutable object? What am I missing?
Edit: I see that this was marked as a possible duplicate. I read through the linked question, but I do not feel that this answers my question. I understand what the CA2104 warning is saying, however I don't understand why this is categorized as a security issue. This is what I am trying to understand.
Having read the documentation on this. I believe that the warning is raised because although the property is marked read-only. There's nothing preventing the user from changing the properties on the read-only property.
Where user would be the consumer of the assembly/library containing the parent type.
Since the property is read-only it's probably been set because the author doesn't want the property to be changed/re-assigned but there's nothing to prevent any of the properties on the child object from being changed. Which is counter to what read-only means. Hence the warning
I suppose it's a tenuous link to security but still valid if the library author wants to protect the exposed object without allowing it to be modified but that's not what is actually happening.
Related
I'm looking to share an EF Context between "data manager" objects to ensure change tracking occurs under one context as opposed to handling multiple contexts...so I'm looking into named context... but in review of this documentation, I felt it wasn't clear, and I want to ensure my assumption is correct, and if so, update the documentation: here PRISM documents the resolution of named instances via a constructor:
My assumption is that the named typed "carservice" is matched to the named parameter in the constructor to select which concrete class should be reference to that parameter based on the IVehicleService.
Is my assumption correct - either way I'll create a pull request to clarify the documentation..Either way, answering the question here will add reference to clarification/handling of named instances in PRISM.
It seems this is NOT correct assumption, and it's not possible in Unity - I refactored to avoid.
One solution that I didn't try was to simply another interface (came to mind much later), was inheriting from an existing interface, and registers the "new" interface to use a specific constructor. As I'm new to Unity, I thought I would mention. I'm answering my own question, as I can't don't think I can give credit to a comment, and I HATE leaving questions unanswered on this site!
I am trying to boost my EF operation performance, and I have found some recommendations regarding DbContext.Configuration.AutoDetectChangesEnabled property
a) in some cases to turn off AutoDetectChangesEnabled - this is clear - I am using it for import functions
b) but then I have noticed this type of approach with enabling this property only before calling SaveChanges():
DbContext db = new DbContext();
db.Configuration.AutoDetectChangesEnabled = false;
//...some changes to POCO properties
db.Configuration.AutoDetectChangesEnabled = true;
db.SaveChanges();
all the changes seem to be correctly saved to database and it works noticably faster compared to approach where AutoDetectChangesEnabled property is leaved intact.
Question
So I wonder is there a reason to leave AutoDetectChangesEnabled intact? What risks there could be if I disable this property by default and then reenable each time before calling DbContext.SaveChanges?
Related post
This post suggests that there might be reasons to leave AutoDetectChangesEnabled==true, but no clear evidence when and why should do so (ok, it says - do so, if entities are EDITED). Has anybody found out argument for/against this?
EF Code First: is good to call DetectChanges just before SaveChanges?
If you look at the documentation Entity Framework Automatic Detect Changes it says:
When using most POCO entities the determination of how an entity has
changed (and therefore which updates need to be sent to the database)
is handled by the Detect Changes algorithm. Detect Changes works by
detecting the differences between the current property values of the
entity and the original property values that are stored in a snapshot
when the entity was queried or attached.
So I think this support the link that you found that if the entity is Edited, with AutoDetectChangesEnabled=true, the change is tracked.
I've been disabling the AutoDetectChangesEnabled for Insert, with great performance improvement.
As far as I can see, the validation within Entity Framework is built entirely around the assumption that, if an item fails its validation, it must not be persisted to the database. Is there any mechanism, possibly running parallel to normal validation, of making a constraint on a field produce a warning to the user, rather than an error which prevents the record from being saved/updated?
To be more specific, I have a situation where a particular numerical field has limits on it, but these are advisory rather than hard-and-fast. If the user enters a value outside these limits, they should get a warning, but should still be able to save the record.
In theory, I could subclass the ValidationResult class to make, say, a ValidationWarning class, then create a custom subclass of ValidationResults whose IsValid property was sensitive to the presence of ValidationWarning messages, and ignored them in deciding whether the entity is valid. However, this requirement has arisen in a project which is already someway along in its development, and it would require a lot of refactoring to make this kind of custom subclassing work properly. I would prefer to find a mechanism which could be levered in without creating that much disruption/rework.
I had a similar requirement on a project and how I solved it was this. If (ModelState.IsValid) is false, I cleared out the errors out of the ModelState and sent it on its way again,then logged the "error" to another service. This is a bit of a hack and I would'nt recommend doing as it is not exactly best practice.
This question may have already been asked, sorry
I'm looking at the architecture for validating our model. Our simple validation can be achieved by using the property validation attributes (some custom) and using
ModelState.IsValid
however the problem is when validation requires access to the database or access to another property. A perfect example is to check for duplicate names. In this case we need to check the database for duplicate names where the id is not equal to that of the current object (for updates)
If we were to write this as an validation attribute to be applied to the name property this would cause to problems. Ome how do we get access to the database and two how would we get access to the id property.
So in conclusion. Is there any examples of good ways to architect a fix to this problem?
I spent some time exploring this today for a project I was working on and came to these conclusions.
It is not to bad to solve the how, much of it involves some reflection and using the validation context to inspect and access other properties of your model or using IValidationObject. The real question becomes is it okay to do validation that requires database interaction.
For one I was concerned about performance, in one particular case a validation made a query that returned an object to ensure it existed which I later needed for relationship assignment which would then cause another query.
Secondly you need to think about database concurrency. The best way to do duplication checks is during insert not before because the database could change between the two operations. This also relates to the first reason, an object could be deleted immediately after a database reported it exists.
In my particular project I felt it better to keep this sort of behavior with modifying my EF context and adding anything that went wrong to the ModelState.
Ok, I am creating a document-based application in Cocoa and the document's file type is actually a package. Within that package is an XML settings file, a SQLite database and a zip file which is downloaded at runtime. Now the only thing that changes, really, is the XML settings file as the other ones can be recreated at run-time.
Each one of these packages will have one and only one window, hence my desire to use document-based. These files can also be copied, renamed, moved, etc. just like any other file that is part of such an architecture.
But I am completely lost as how to implement this in the Documentation Framework! It seems everywhere I look in the docs it's always talking about in-memory representations of the files which you then write out using the path presented to you in one of the NSDocument overrides (since Cocoa may move it, etc.) But again, I'm using a SQLite database that sits on disk, not in memory.
I have looked all over for overridable methods that would still give me things like dirty-state checking of the doc, open and save file dialog support and the like, but I can't seem to find anything that just says 'Here's a file URL... Open it as you see fit' althought I did get close at the application's delegate level, at least for the opening.
So let's assume that's working as expected. How do I implement the save/save-as where I want to control everything that is written to disk or not? I don't want to (not can I) mess around with data structures or the like. I just want to be given a psth that the user selects in the 'Save As' dialog (for new) and be able to write what I need to there. Simple. But again, the 50+ page document from developer.apple.com about Document-based architecture tells me where to overload a lot of things, but every one seems to stem from some in-memory representation of the document, which again, is not what my package is. Technically, only the internal XML file is what would be tied to the document. Everything else is just support for it.
So? Anyone? Takers?
Mark
I can't seem to find anything that just says 'Here's a file URL... Open it as you see fit'
Implement the readFromURL:ofType:error: method in your document class. Alternatively, since your document type is a package type, implement the readFromFileWrapper:ofType:error: method.
You don't have to read the data into memory; you can do whatever you want in whichever method you implement, including opening the database.
How do I implement the save/save-as where I want to control everything that is written to disk or not?
Implement the writeToURL:ofType:error: method or the fileWrapperOfType:error: method.
If you had or could easily create data in memory, you would implement the readFromData:ofType:error: and dataOfType:error: methods. The URL-based and file-wrapper-based methods are for cases where data in memory is not an option. And the primary use of file wrappers is for package types like yours.
Actually, I found it. It's not the 'writeTo' methods, but rather the 'saveTo' methods you want to override. When I did that, the saving code worked as I expected, including automatic save panel support. For clarity, this is the one I chose...
saveToURL:ofType:forSaveOperation:error:
and it works like a champ! Not too confusing now, was it! Sheesh!!!
That was of course the very first thing that I tried, but if you read the developer documentation--specifically the Cocoa Document-Based Architecture--here's what it says about those very methods...
During writing, your document may be asked to write its contents to a different location or using a different file type. Again, your overridden method should be able to determine everything it needs to do the writing from the passed-in parameters.
If your override cannot determine all of the information it needs from the passed-in parameters, consider overriding another method. For example, if you see the need to invoke fileURL from within an override of readFromData:ofType:error:, perhaps you should instead override readFromURL:ofType:error:. For another example, if you see the need to invoke fileURL from within an override of writeToURL:ofType:error:, perhaps you should instead override writeToURL:ofType:forSaveOperation:originalContentsURL:error:.
In other words, it seems to say that you can't assume the URL that is passed to you is the actual place on disk where the 'something' is eventually written to, which wreaks havoc when dealing with database files that are opened by URL. Maybe I'm missing something.
But ok... forget I read that and simply even try to just override those methods. I do and return TRUE for each, (I log the URL so I can see what is being passed in), I get this error on 'Save As' after you have chosen a filename...
2009-10-28 14:31:51.548 XPanel[1001:a0f] dataOfType:error: is a subclass responsibility but has not been overridden.
...but when you look at the documentation for that it says the default implementation throws an exception because you must override one of the other implementations above... which I obviously just did! Plus, again, this can't be represented as simple data!
So grasping at straws here, I overrode that one too and just returned nil, since again, you can't represent what I'm doing with a NSData object. Then I get a 'Can't be saved' message.
WTF?! Why is it calling that thing anyway??!!
...and that's when I gave up and posted this here.
Now if YOU can give me a simple example that perhaps doesn't even actually read or write a file but instead just logs the URL, that would be perfect. Not to useful but still, it should work... I just can't seem to implement get it to.