怎么能不使用"最后"是一个安全问题?是一个、能不、安全问题、QUOT

2023-09-08 13:30:16 作者:甜你许久

从O'Reilly的113页的基本的ActionScript 3.0 的(2007):

  

中的方法是最终帮助隐藏类的内部细节。制作类或   方法最终prevents其他程序员从扩展类或重写   该方法用于检查类的内部结构的目的。这样的prevention   从正在考虑的方式为维护应用程序之一   恶意利用

这是否指的是编译的,封闭源代码包的API的用户,而恶意利用学习关于类设计的东西呢?这真的是一个问题吗?

有关更多一些情况下,它是两个原因使用最后第二。在2007年版,它的113页上的字幕下章的继承的被扩展preventing类和方法被覆盖的。

  

最后一个属性用于两个原因在ActionScript:

        

在某些情况下,最终的执行方法比非最终方法快。如果你   希望提高无微不至应用程序的性能,请尝试   使得它的方法决赛。但是请注意,在今后的Flash运行时,Adobe公司   预计非最终方法为快速执行的最后方法。

  

中的方法是最终帮助隐藏类的内部细节。制作类或   方法最终prevents其他程序员从扩展类或重写   该方法用于检查类的内部结构的目的。这样的prevention   被认为是一种方式来保护应用程序免受   恶意利用。

   解决方案 婚姻家事不简单 离婚纠纷中的股权转让

在许多语言中,覆盖方法是选择在从基类。通常情况下,它是虚拟关键字,可以让基类的作者可以选择在用于覆盖的可能性。

在AS3,但是,有重载方法的能力是选择退出。这正是最后关键字一样。它允许基类的作者说这种方法可能不会被覆盖。

有一些老派的看法关于封装,将表明,它是一个安全问题AS3做这种方式。但是,这主要是在其中要隐藏你的内容,但功能公开公共API的情况下。

但是,在更多的现代,我们已经了解到,拆卸和反射将允许恶意的开发者做任何他/她反正要,所以这是今天不再是一个问题。依托最后的安全是一个拐杖,在我看来,和它的任何建议,应予以驳回。安全必须比这更深思熟虑的。 API的需要进行架构,这样的实施可以让开发者有什么话需要做的,但安全重要信息不应该包括在公开的API。

这是不是说,最后是没有用的。 最后告诉您的类,你绝对不希望他们重写功能得到开发。它可以让你说请你只调用这个函数。不覆盖。它更多的是一种接口或通信机制比什么都重要的,IMO。

From page 113 of O'Reilly's Essential ActionScript 3.0 (2007):

Methods that are final help hide a class’s internal details. Making a class or a method final prevents other programmers from extending the class or overriding the method for the purpose of examining the class’s internal structure. Such prevention is considered one of the ways to safeguard an application from being maliciously exploited.

Does this refer to users of the API of a compiled, closed-source package, and "maliciously exploited" to learning things about the class design? Is this really a problem?

For some more context, it's the second of two reasons to use final. In the 2007 edition, it's on page 113 in the chapter Inheritance under subtitle Preventing Classes from Being Extended and Methods from Being Overridden.

The final attribute is used for two reasons in ActionScript:

In some situations, final methods execute faster than non-final methods. If you are looking to improve your application’s performance in every possible way, try making its methods final. Note, however, that in future Flash runtimes, Adobe expects non-final methods to execute as quickly as final methods.

Methods that are final help hide a class’s internal details. Making a class or a method final prevents other programmers from extending the class or overriding the method for the purpose of examining the class’s internal structure. Such prevention is considered one of the ways to safeguard an application from being maliciously exploited.

解决方案

In many languages, overriding methods is opt-in from the base class. Often, it is the virtual keyword that allows base class authors to opt-in for the possibility of overriding.

In AS3, however, the ability to have methods overridden is opt-out. That is what the final keyword does. It allows the base class author to say "this method may not be overridden".

There are some old-school thoughts about encapsulation that would suggest that it is a security problem for AS3 to do it this way. But this is mostly in cases of public APIs in which you want to hide your content but expose the functionality.

But, in more modern times, we have learned that disassembly and reflection will allow a malicious developer to do anything he/she wants anyways, so this is less of an issue today. Relying on final for security is a crutch, in my opinion, and any suggestions of it should be dismissed. Security needs to be thought of more carefully than that. APIs need to be architected such that the implementation lets developers do what then need to do, but security-critical information should not be included in public APIs.

That is not to say that final is not useful. final tells developers that derive from your class that you never intended them to override the function. It lets you say "please just call this function. Don't override." It is more of an interface or a communications mechanism than anything else, IMO.