Export (0) Print
Expand All

Wrap vulnerable finally clauses in outer try

TypeName

WrapVulnerableFinallyClausesInOuterTry

CheckId

CA2124

Category

Microsoft.Security

Breaking Change

NonBreaking

A public or protected method contains a try - finally block. The finally block appears to reset security state and is not enclosed in a finally block.

This rule locates try-finally blocks that might be vulnerable to malicious exception filters present in the call stack. If sensitive operations such as impersonation occur in the try block, and an exception is thrown, the filter can execute before the finally block. For the impersonation example, this means that the filter would execute as the impersonated user. Filters are currently implementable only in Visual Basic.

Place the unwrapped try-finally in an outer try block. See the second example that follows. This forces the finally to execute before filter code.

Do not exclude a warning from this rule.

The following pseudo-code illustrates the pattern detected by this rule.

try {
   // Do some work.
   Impersonator imp = new Impersonator("John Doe");
   imp.AddToCreditCardBalance(100);
}
finally {
   // Reset security state.
   imp.Revert();
}

The following pseudo-code shows the pattern you can use to protect your code and satisfy this rule.

try {
     try {
        // Do some work.
     }
     finally {
        // Reset security state.
     }
}
catch()
{
    throw;
}

Community Additions

ADD
Show:
© 2014 Microsoft