Bug in InitializePerTypeRules

Bug in InitializePerTypeRules

Old forum URL: forums.lhotka.net/forums/t/10638.aspx


xal posted on Thursday, August 25, 2011

I have a class that can be used by itself or as a base class to others. This class has it's own set of authorization rules.

I have a second class that inherits from the first one that doesn't have an AddObjectAuthorizationRules method.

 

So, in my scenario, I use the base class once, and the auth rules for that type are initialized. Then I use the second class and since the reflection code that gets the AddObjectAuthorizationRules method uses the FlattenHierarchy binding flag, it gets the method from the base class. It then proceeds to call it, but since it has already been called, when it attempts to add the rules, you get an argument exception because this rule has already been added.

 

I think the InitializePerTypeRules should check if the DeclaringType for the method is the current type and, if not, attempt to initialize the rules for the declaring type and abort the initialization for the current type.

This also raises the question on whether the auth rules should walk the inheritance chain and check auth rules for base types (which I believe does not). If not, then maybe the FlattenHierarchy binding flag could just be removed and the problem would be solved.

As a side note, the exception being thrown is very unfriendly. The description for the exception is just "rule".

Cheers,

Andrés

RockfordLhotka replied on Thursday, August 25, 2011

Bug recorded: http://www.lhotka.net/cslabugs/edit_bug.aspx?id=952

JonnyBee replied on Monday, January 02, 2012

Andrés Villanueva

So, in my scenario, I use the base class once, and the auth rules for that type are initialized. Then I use the second class and since the reflection code that gets the AddObjectAuthorizationRules method uses the FlattenHierarchy binding flag, it gets the method from the base class. It then proceeds to call it, but since it has already been called, when it attempts to add the rules, you get an argument exception because this rule has already been added.

If the AddObjectAuthorizationRules is delared as a private static method in the base class then it will not be called from a child object (not found by reflection). This the typical scope that we have defined this method at so we haven't experienced/recognized this behavior previously.

If the method is declared a public or protected in the base class it will be called from a child without the method.

This is updated in trunk now so that the base class implementation will not be called  (ie changed BindingFlags.FlattenHierarchy to BindingFlags.DeclaredOnly).

Copyright (c) Marimer LLC