Some times ago, I decided to post a question that I had in my mind for a long time.
It was about the evilness of Eval
in C#.
There are several posts from Microsoft MVP and C# developers on the subject.
You can learn how it works. Learn about the late binding. The compiler call.
All those posts are basically about performance, debugging.
But, in my mind Eval comes with a security hole. There are several casual allusions to the security issue. I just fail to find real documentation about this point.
So I felt like Stack Overflow was a good place to ask about it.
With no harm intended, not trying to hack or anything, the question was simple:
What can an eval on a db stored string can do that a more classical databind won't?
So everything that could be harmful with a simple databind was outside the scope of the question.
It was not really asking for any proof of concept for a server wipe exploit.
It was more about the current restriction C# eval has or doesn't have.
The list of exploits that could be done even without proof was shown.
But I have made mistakes:
Even if I try to make my post clear and show my non-harmful intentions. My broken English and low rep may fool people into thinking I was a weird hacker. As they often fail to hide their intentions.
My early research on the topic was too light. I just quickly read the top 10 Google results on the subject.
And assumed that my question was legitimate and not fully answered by those posts.
Perhaps the Eval subject was an unspoken taboo, and asking about it made people direct their hate against this thing against the post.
The post could possibly be more on-topic on Security Stack Exchange.
With all those mistakes, I quickly reached the score of -10 on this question. Resulting in a question close. And a ban from asking.
I understand the ban as I mainly ask and post about telerik. And the low amount of visits in that tag doesn't bring many upvotes/downvotes.
With a low ratio of quality posts on the subject.
Expecting a meta effect, the only thing I would ask is how could I make this question "ok" for the community? Or how to stop the bleeding?
The question is about what could go wrong. Not about how to prevent it. It's not about how to fix Eval. It should be an advocacy on why not to use it based on the security aspect.