views:

218

answers:

2

Hello everyone,

I am using VSTS 2008 + C# + .Net 2.0 to develop Windows Forms application. I found by default, the new Form we created will be marked as public partial.

My concern is whether expose class as public has any security risks? Should we mark it as private? Any impact for functionality if we mark it as private?

BTW: I met with compile error when marking the class from public partial as private. Here is the compile error message, any ideas what is wrong?

Error   1 Elements defined in a namespace cannot be explicitly declared as private, protected, or protected internal C:\FooTest\Form1.Designer.cs

thanks in advance, George

+1  A: 

It's exactly as the error message says - classes (and other types) declared in namespace scope cannot be private, because private means "no-one but enclosing class can see this", and there's no enclosing class at namespace scope.

If you want the class to not be seen from outside of assembly, you should use internal.

Pavel Minaev
If I mark it as internal, any functional impact to the Windows Forms application? For example, not sure if .Net runtime will use reflection to manipulate the class from other assemblies (if mark as internal, no access from other assembly including .Net assembly are allowed)?
George2
Why would .NET runtime need to manipulate your form class from other assemblies? It might need to manipulate _members_ of an _instance_ of your class (e.g. if you use data binding), but this isn't affected by making the class `internal`. So it'll work fine.
Pavel Minaev
Hi Pavel, my confusion is if I make my class as internal, access from all other assemblies are denied -- I think it also means all access to the members of the class is denied. Correct?
George2
Not quite. "Access is denied" in a sense that another assembly cannot reference yours, and directly address members of your classes. But obviously no .NET stock assembly is going to reference your assembly. When it comes to Reflection, "internal" _may_ mean that other assemblies cannot create an instance of your class with Reflection (but in WinForms app usually doesn't because it has FullTrust anyway, which includes ReflectionPermission, which allows to disregard accessibility for Reflection purposes).
Pavel Minaev
Thanks Pavel, about the permission issue, I have a long confusion. :-) In .Net, we could set fulltrust property of SecurityAttribute to either true or false as it is a bool type property. But permission in a straightforward understanding, there should be only two status -- granted and not-granted, what does th full and non-full mean? the word "unrestricted" makes me think that when unrestricted is false, it means limited/partial permission (the opposite of full is partial/limited). I am confused the "opposite" of unrestricted is none permission or partial permission?
George2
If you are interested, you can see my confusion here and appreciate if you could comment and help from your expertise.http://stackoverflow.com/questions/1160146/securityattribute-unrestricted-issue
George2
+2  A: 

If you define it private, then what's the purpose of having the class? Nobody outside that file will have access to it. Not even your main program (probably running on Program.cs).

Partial means that your class was divided, so your Form class has more components than the one in your Form.cs file. VS just put the automatic generated code in one file and your code in another. So you can not eliminate the partial unless you move all the generated code into a single file, but if you do that and use the Form Designer to change a label font, then you are doom!.

Freddy
You cannot define a non-nested class as `private` in C#, period.
Pavel Minaev
Thanks Freddy and Pavel, I want to make the Forms application function as good as before and do not expose any additional information outside. I think making the Forms class public may expose the information which I do not want to expose. Any advice for me?
George2
Then don't have the sensitive information 'inside' function. You could have a class which contains all your sensitive information. This class could be a private member of main (I don't think it will be a good idea) or you could have a third class which will be in charge of passing the information to the Form. That will be like a Model View Controller pattern, where your data will be the Model, the Controller will be the one taking decisions and passing data from the Model to the Form (which will be the view).
Freddy
Sorry, I meant don't have the information inside the Form not function.
Freddy
Thanks Freddy, we can only make a nest class as private? Why? I am confused.
George2
"This class could be a private member of main" -- you mean making the (sensitive information containing) class as a private nested class inside method main?
George2
"don't have the information inside the Form not function" -- could you speak in some other words please?
George2
First- "don't have the information inside the Form not function", Ignore that comment, it jas just a typo.Second- "we can only make a nest class as private? Why? I am confused"Yes, as Pavel mentioned you could not have non-nested classes as private. However, that was not what I was referring, you will have a public class with the sensitive information, and this public class will be a private member of your Form (not the best option as I explained before). So, in that way Main Form is public, but will contain a private object which can only be accessed by Form.
Freddy