{"action":"created","issue":{"url":"https://api.github.com/repos/KeenSoftwareHouse/SpaceEngineers/issues/398","labels_url":"https://api.github.com/repos/KeenSoftwareHouse/SpaceEngineers/issues/398/labels{/name}","comments_url":"https://api.github.com/repos/KeenSoftwareHouse/SpaceEngineers/issues/398/comments","events_url":"https://api.github.com/repos/KeenSoftwareHouse/SpaceEngineers/issues/398/events","html_url":"https://github.com/KeenSoftwareHouse/SpaceEngineers/issues/398","id":99822502,"number":398,"title":"IlInjector does not properly rewrite type usages","user":{"login":"alex-davidson","id":2283446,"avatar_url":"https://avatars.githubusercontent.com/u/2283446?v=3","gravatar_id":"","url":"https://api.github.com/users/alex-davidson","html_url":"https://github.com/alex-davidson","followers_url":"https://api.github.com/users/alex-davidson/followers","following_url":"https://api.github.com/users/alex-davidson/following{/other_user}","gists_url":"https://api.github.com/users/alex-davidson/gists{/gist_id}","starred_url":"https://api.github.com/users/alex-davidson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex-davidson/subscriptions","organizations_url":"https://api.github.com/users/alex-davidson/orgs","repos_url":"https://api.github.com/users/alex-davidson/repos","events_url":"https://api.github.com/users/alex-davidson/events{/privacy}","received_events_url":"https://api.github.com/users/alex-davidson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-08T18:00:40Z","updated_at":"2015-08-08T22:12:18Z","closed_at":null,"body":"Consider the following:\r\n```\r\npublic static B SelectSomething(A source) { return new B(); }\r\npublic struct B {}\r\npublic struct A {} \r\n \r\nvoid Main()\r\n{\r\n\tvar list = new List<A>();\r\n\tlist.Add(new A());\r\n\t\r\n\tB[] result = System.Linq.Enumerable.ToArray(System.Linq.Enumerable.Select(list, SelectSomething));\r\n}\r\n```\r\n\r\nModifying MyProgrammableBlock.cs CompileAndCreateInstance to pass a final 'true' parameter to IlInjector.InjectCodeToAssembly will write out an IngameScript_safe.dll to the game's bin folder when the script is compiled. There will also be an IngameScript.dll present, which is highly suspicious since it's supposed to be in-memory only.\r\n\r\nThe reason why IngameScript.dll is present too is that it's *referenced by* IngameScript_safe.dll! The return type of SelectSomething will be Program.B from IngameScript rather than just B from IngameScript_safe.dll.\r\n\r\nI'm not sure if this might be used to break the sandbox since the IL is still checked, but it does cause otherwise-valid programs to fail with obscure type-cast errors.\r\n\r\nIlInjector.InjectTypes seems to assume that collecting types in inheritance order is sufficient, but it is not."},"comment":{"url":"https://api.github.com/repos/KeenSoftwareHouse/SpaceEngineers/issues/comments/129057800","html_url":"https://github.com/KeenSoftwareHouse/SpaceEngineers/issues/398#issuecomment-129057800","issue_url":"https://api.github.com/repos/KeenSoftwareHouse/SpaceEngineers/issues/398","id":129057800,"user":{"login":"alex-davidson","id":2283446,"avatar_url":"https://avatars.githubusercontent.com/u/2283446?v=3","gravatar_id":"","url":"https://api.github.com/users/alex-davidson","html_url":"https://github.com/alex-davidson","followers_url":"https://api.github.com/users/alex-davidson/followers","following_url":"https://api.github.com/users/alex-davidson/following{/other_user}","gists_url":"https://api.github.com/users/alex-davidson/gists{/gist_id}","starred_url":"https://api.github.com/users/alex-davidson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex-davidson/subscriptions","organizations_url":"https://api.github.com/users/alex-davidson/orgs","repos_url":"https://api.github.com/users/alex-davidson/repos","events_url":"https://api.github.com/users/alex-davidson/events{/privacy}","received_events_url":"https://api.github.com/users/alex-davidson/received_events","type":"User","site_admin":false},"created_at":"2015-08-08T22:12:18Z","updated_at":"2015-08-08T22:12:18Z","body":"I'm not entirely sure how generic methods ever worked here. I suspect the game always ended up calling the methods from the original binary, ignoring the injected version entirely and bypassing the instruction limits, etc."}}